{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-a19910a272730878", "name": "Possibly dead Python function: load_registry_document", "shortDescription": {"text": "Possibly dead Python function: load_registry_document"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1d058db4cb962f60", "name": "Possibly dead Python function: decorator", "shortDescription": {"text": "Possibly dead Python function: decorator"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0c308910b29ecf22", "name": "Possibly dead Python function: read_inventory", "shortDescription": {"text": "Possibly dead Python function: read_inventory"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fea958835e4af043", "name": "Possibly dead Python function: list_for_harnesses", "shortDescription": {"text": "Possibly dead Python function: list_for_harnesses"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d75f44fb288b870e", "name": "Possibly dead Python function: require_remote_bearer", "shortDescription": {"text": "Possibly dead Python function: require_remote_bearer"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3724f783c216dc59", "name": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/app.js:293", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/app.js:293"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c80f7f46cd0ffe43", "name": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/approval-workbench.js:89", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/approval-workbench.js:89"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1821734c1acb5485", "name": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/vibe-coding-launcher.js:72", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/vibe-coding-launcher.js:72"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-944228efef5b15c2", "name": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/control-plane-editor.js:58", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/control-plane-editor.js:58"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-13a6e84806231ab0", "name": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/remote-console.js:117", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/remote-console.js:117"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-34a36bf8d6ac24dc", "name": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/config-editor.js:99", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/config-editor.js:99"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-08c360e2f41d65f6", "name": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/chat-launcher.js:166", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/chat-launcher.js:166"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d675be9f12f14571", "name": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/catalog-editor.js:218", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/catalog-editor.js:218"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4b02b62bd4dd0320", "name": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/workspace-manager.js:55", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/workspace-manager.js:55"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-14a182de47f697e9", "name": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/tool-discovery.js:165", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/tool-discovery.js:165"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2964f1e7ebd82c18", "name": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/registry-editor.js:66", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/registry-editor.js:66"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-23f12c77701e59a4", "name": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/rollback.js:24", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/rollback.js:24"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fb3523830e5f23d2", "name": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/profile-editor.js:79", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/profile-editor.js:79"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-31ae370b192d7259", "name": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/discover-bind.js:48", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/discover-bind.js:48"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f249d8465ae75518", "name": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/provider-switchboard.js:118", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/provider-switchboard.js:118"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6775585c6a3a33f4", "name": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/daily-dashboard.js:50", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/daily-dashboard.js:50"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1d2146a84b496856", "name": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/dashboard-v2.js:115", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/dashboard-v2.js:115"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-abe305d73d5dbbd4", "name": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/agentic-inventory.js:86", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/agentic-inventory.js:86"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8ec2176153fa3156", "name": "Very large file: tests/test_cli.py (2391 lines)", "shortDescription": {"text": "Very large file: tests/test_cli.py (2391 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c0694227f9f24cff", "name": "Very large file: tests/test_api.py (3184 lines)", "shortDescription": {"text": "Very large file: tests/test_api.py (3184 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1d458bd2f4806cce", "name": "Very large file: apps/web/app.js (1490 lines)", "shortDescription": {"text": "Very large file: apps/web/app.js (1490 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ba3ca86083124d21", "name": "Very large file: src/agentic_os/api.py (3523 lines)", "shortDescription": {"text": "Very large file: src/agentic_os/api.py (3523 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ebdddf2b3d584c13", "name": "Very large file: src/agentic_os/control_plane.py (1594 lines)", "shortDescription": {"text": "Very large file: src/agentic_os/control_plane.py (1594 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d57b3f82d2270c5b", "name": "Node manifest has dependencies but no lockfile: apps/desktop/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/desktop/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, lockfile. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e725d2ab884fbd49", "name": "Multiple root agent instruction files without precedence", "shortDescription": {"text": "Multiple root agent instruction files without precedence"}, "fullDescription": {"text": "The repo has multiple top-level AI-coder instruction files. Without precedence rules, different agents may follow different policies."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a416be3f6518c530", "name": "Legacy-named symbol `model_copy` in tests/test_storage.py:128", "shortDescription": {"text": "Legacy-named symbol `model_copy` in tests/test_storage.py:128"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8ca86f990e2ead7e", "name": "Legacy-named symbol `contract_from_agent_v2` in tests/test_adapter_contract.py:11", "shortDescription": {"text": "Legacy-named symbol `contract_from_agent_v2` in tests/test_adapter_contract.py:11"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-574bea7e8f73966c", "name": "Legacy-named symbol `test_upsert_skill_creates_file_with_sidecar_backup` in tests/test_safe_edit.py:74", "shortDescription": {"text": "Legacy-named symbol `test_upsert_skill_creates_file_with_sidecar_backup` in tests/test_safe_edit.py:74"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-31aa9d31c6cdbcef", "name": "Commented-code block (6 lines) in tests/test_registry.py:103", "shortDescription": {"text": "Commented-code block (6 lines) in tests/test_registry.py:103"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ee30df0508e6a02f", "name": "Legacy-named symbol `test_skill_can_be_deprecated_and_upsert_resets_deprecated` in tests/test_control_plane.py:344", "shortDescription": {"text": "Legacy-named symbol `test_skill_can_be_deprecated_and_upsert_resets_deprecated` in tests/test_control_plane.py:344"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-155da53a519fd303", "name": "Legacy-named symbol `mcp_copy` in tests/test_cli.py:117", "shortDescription": {"text": "Legacy-named symbol `mcp_copy` in tests/test_cli.py:117"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-32c579d69f08de83", "name": "Legacy-named symbol `skill_deprecated` in tests/test_api.py:934", "shortDescription": {"text": "Legacy-named symbol `skill_deprecated` in tests/test_api.py:934"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b8ab2dece5b3067e", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/web/api.js:183", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/web/api.js:183"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dba4f1d3e623b7a2", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/web/ui/product-polish.js:76", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/web/ui/product-polish.js:76"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aa7c9851055da3b5", "name": "Network/subprocess call without timeout or try/except \u2014 src/agentic_os/evidence.py:339", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 src/agentic_os/evidence.py:339"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-65872985bb6c3923", "name": "Legacy-named symbol `mcp_copy` in src/agentic_os/client.py:53", "shortDescription": {"text": "Legacy-named symbol `mcp_copy` in src/agentic_os/client.py:53"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-23a736395f69a417", "name": "Legacy-named symbol `would_backup` in src/agentic_os/safe_edit.py:104", "shortDescription": {"text": "Legacy-named symbol `would_backup` in src/agentic_os/safe_edit.py:104"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b5b885fe3c07f7a7", "name": "Legacy-named symbol `model_copy` in src/agentic_os/registry.py:170", "shortDescription": {"text": "Legacy-named symbol `model_copy` in src/agentic_os/registry.py:170"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ae40fadde065f7da", "name": "Legacy-named symbol `contract_from_agent_v2` in src/agentic_os/adapter_contract.py:179", "shortDescription": {"text": "Legacy-named symbol `contract_from_agent_v2` in src/agentic_os/adapter_contract.py:179"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ebfc3b76c5783d75", "name": "Stub function `main` (body is just `pass`/`return`) \u2014 src/agentic_os/daemon.py:18", "shortDescription": {"text": "Stub function `main` (body is just `pass`/`return`) \u2014 src/agentic_os/daemon.py:18"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-639cd424e93f0e8a", "name": "Legacy-named symbol `model_copy` in src/agentic_os/logs.py:140", "shortDescription": {"text": "Legacy-named symbol `model_copy` in src/agentic_os/logs.py:140"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6e677361d064c040", "name": "Legacy-named symbol `tools_mcp_copy` in src/agentic_os/cli.py:361", "shortDescription": {"text": "Legacy-named symbol `tools_mcp_copy` in src/agentic_os/cli.py:361"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7427683ec0705bb8", "name": "Legacy-named symbol `contract_from_agent_v2` in src/agentic_os/api.py:78", "shortDescription": {"text": "Legacy-named symbol `contract_from_agent_v2` in src/agentic_os/api.py:78"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8a570570c803bac1", "name": "Network/subprocess call without timeout or try/except \u2014 src/agentic_os/api.py:1563", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 src/agentic_os/api.py:1563"}, "fullDescription": {"text": "`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nsrc/agentic_os/client.py:deprecate_skill, src/agentic_os/control_plane.py:deprecate_skill, src/agentic_os/control_plane.py:deprecate_skill_tracked\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nsrc/agentic_os/client.py:deprecate_mcp_server, src/agentic_os/control_plane.py:deprecate_mcp_server\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49c98f7cedd9c977", "name": "Near-duplicate function bodies in 4 places", "shortDescription": {"text": "Near-duplicate function bodies in 4 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nsrc/agentic_os/cli.py:config_effective, src/agentic_os/cli.py:config_explain, src/agentic_os/cli.py:harness_config_effective_cmd, src/agentic_os/cli.py:harness_config_explain_cmd\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dddb0126b6c7a951", "name": "FastAPI POST `mcp_copy` without auth dependency \u2014 src/agentic_os/api.py:534", "shortDescription": {"text": "FastAPI POST `mcp_copy` without auth dependency \u2014 src/agentic_os/api.py:534"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8b2f9ad8eadb912a", "name": "FastAPI POST `mcp_remove` without auth dependency \u2014 src/agentic_os/api.py:568", "shortDescription": {"text": "FastAPI POST `mcp_remove` without auth dependency \u2014 src/agentic_os/api.py:568"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-694034f9a1a6e33c", "name": "FastAPI POST `upsert_profile` without auth dependency \u2014 src/agentic_os/api.py:740", "shortDescription": {"text": "FastAPI POST `upsert_profile` without auth dependency \u2014 src/agentic_os/api.py:740"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cf6c2552dc39240d", "name": "FastAPI DELETE `delete_profile` without auth dependency \u2014 src/agentic_os/api.py:768", "shortDescription": {"text": "FastAPI DELETE `delete_profile` without auth dependency \u2014 src/agentic_os/api.py:768"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-aacfd945bca66e34", "name": "FastAPI POST `bind_project_profile` without auth dependency \u2014 src/agentic_os/api.py:825", "shortDescription": {"text": "FastAPI POST `bind_project_profile` without auth dependency \u2014 src/agentic_os/api.py:825"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-016ec28ee0d9e3ff", "name": "FastAPI POST `run_session` without auth dependency \u2014 src/agentic_os/api.py:989", "shortDescription": {"text": "FastAPI POST `run_session` without auth dependency \u2014 src/agentic_os/api.py:989"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-524bc536af8f7918", "name": "FastAPI POST `sessions_discover` without auth dependency \u2014 src/agentic_os/api.py:1319", "shortDescription": {"text": "FastAPI POST `sessions_discover` without auth dependency \u2014 src/agentic_os/api.py:1319"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-74887be41480f640", "name": "FastAPI POST `sessions_bind` without auth dependency \u2014 src/agentic_os/api.py:1346", "shortDescription": {"text": "FastAPI POST `sessions_bind` without auth dependency \u2014 src/agentic_os/api.py:1346"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f40336e2d90c4948", "name": "FastAPI POST `stop_session` without auth dependency \u2014 src/agentic_os/api.py:1414", "shortDescription": {"text": "FastAPI POST `stop_session` without auth dependency \u2014 src/agentic_os/api.py:1414"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-53b3603238ebf765", "name": "FastAPI POST `retry_session` without auth dependency \u2014 src/agentic_os/api.py:1423", "shortDescription": {"text": "FastAPI POST `retry_session` without auth dependency \u2014 src/agentic_os/api.py:1423"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-33946877ba69fb76", "name": "FastAPI POST `attach_session` without auth dependency \u2014 src/agentic_os/api.py:1511", "shortDescription": {"text": "FastAPI POST `attach_session` without auth dependency \u2014 src/agentic_os/api.py:1511"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0ad3e108a881ea54", "name": "FastAPI POST `approve_approval` without auth dependency \u2014 src/agentic_os/api.py:1601", "shortDescription": {"text": "FastAPI POST `approve_approval` without auth dependency \u2014 src/agentic_os/api.py:1601"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-704f8dcdf66a8a86", "name": "FastAPI POST `reject_approval` without auth dependency \u2014 src/agentic_os/api.py:1698", "shortDescription": {"text": "FastAPI POST `reject_approval` without auth dependency \u2014 src/agentic_os/api.py:1698"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f02f0823d5fdaf8c", "name": "FastAPI POST `create_session_memory_summary` without auth dependency \u2014 src/agentic_os/api.py:1725", "shortDescription": {"text": "FastAPI POST `create_session_memory_summary` without auth dependency \u2014 src/agentic_os/api.py:1725"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3c063e3d1f2e215d", "name": "FastAPI POST `create_session_memory_review` without auth dependency \u2014 src/agentic_os/api.py:1743", "shortDescription": {"text": "FastAPI POST `create_session_memory_review` without auth dependency \u2014 src/agentic_os/api.py:1743"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ee448becb3fcbf4d", "name": "FastAPI POST `approve_memory_review` without auth dependency \u2014 src/agentic_os/api.py:1755", "shortDescription": {"text": "FastAPI POST `approve_memory_review` without auth dependency \u2014 src/agentic_os/api.py:1755"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a7f35344319b9b79", "name": "FastAPI POST `reject_memory_review` without auth dependency \u2014 src/agentic_os/api.py:1764", "shortDescription": {"text": "FastAPI POST `reject_memory_review` without auth dependency \u2014 src/agentic_os/api.py:1764"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-659def1f81c9529d", "name": "FastAPI POST `upsert_skill` without auth dependency \u2014 src/agentic_os/api.py:1796", "shortDescription": {"text": "FastAPI POST `upsert_skill` without auth dependency \u2014 src/agentic_os/api.py:1796"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7915e1c8ae3c4963", "name": "FastAPI POST `skill_rollback` without auth dependency \u2014 src/agentic_os/api.py:1837", "shortDescription": {"text": "FastAPI POST `skill_rollback` without auth dependency \u2014 src/agentic_os/api.py:1837"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e15b6d6b0fd52a7b", "name": "FastAPI POST `disable_skill` without auth dependency \u2014 src/agentic_os/api.py:1861", "shortDescription": {"text": "FastAPI POST `disable_skill` without auth dependency \u2014 src/agentic_os/api.py:1861"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-365408aaaee2d3ea", "name": "FastAPI POST `deprecate_skill` without auth dependency \u2014 src/agentic_os/api.py:1876", "shortDescription": {"text": "FastAPI POST `deprecate_skill` without auth dependency \u2014 src/agentic_os/api.py:1876"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-272e0004d9ad51cf", "name": "FastAPI POST `undeprecate_skill` without auth dependency \u2014 src/agentic_os/api.py:1903", "shortDescription": {"text": "FastAPI POST `undeprecate_skill` without auth dependency \u2014 src/agentic_os/api.py:1903"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e53975fbcb24d9e5", "name": "FastAPI POST `upsert_mcp_server` without auth dependency \u2014 src/agentic_os/api.py:1937", "shortDescription": {"text": "FastAPI POST `upsert_mcp_server` without auth dependency \u2014 src/agentic_os/api.py:1937"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fb524d2504d81b15", "name": "FastAPI POST `mcp_rollback` without auth dependency \u2014 src/agentic_os/api.py:1979", "shortDescription": {"text": "FastAPI POST `mcp_rollback` without auth dependency \u2014 src/agentic_os/api.py:1979"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-49059ec19f21f7fc", "name": "FastAPI POST `disable_mcp_server` without auth dependency \u2014 src/agentic_os/api.py:2003", "shortDescription": {"text": "FastAPI POST `disable_mcp_server` without auth dependency \u2014 src/agentic_os/api.py:2003"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-26c672aeeb040488", "name": "FastAPI POST `deprecate_mcp_server` without auth dependency \u2014 src/agentic_os/api.py:2018", "shortDescription": {"text": "FastAPI POST `deprecate_mcp_server` without auth dependency \u2014 src/agentic_os/api.py:2018"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8ddff2c792142fb7", "name": "FastAPI POST `undeprecate_mcp_server` without auth dependency \u2014 src/agentic_os/api.py:2045", "shortDescription": {"text": "FastAPI POST `undeprecate_mcp_server` without auth dependency \u2014 src/agentic_os/api.py:2045"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ea508bada721ded7", "name": "FastAPI POST `evaluate_policy` without auth dependency \u2014 src/agentic_os/api.py:2069", "shortDescription": {"text": "FastAPI POST `evaluate_policy` without auth dependency \u2014 src/agentic_os/api.py:2069"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9b48be365a19d040", "name": "FastAPI POST `upsert_policy` without auth dependency \u2014 src/agentic_os/api.py:2098", "shortDescription": {"text": "FastAPI POST `upsert_policy` without auth dependency \u2014 src/agentic_os/api.py:2098"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bb79eb6854493d5a", "name": "FastAPI POST `policy_rollback` without auth dependency \u2014 src/agentic_os/api.py:2142", "shortDescription": {"text": "FastAPI POST `policy_rollback` without auth dependency \u2014 src/agentic_os/api.py:2142"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c54aeeb220a52aa9", "name": "FastAPI POST `deprecate_policy` without auth dependency \u2014 src/agentic_os/api.py:2166", "shortDescription": {"text": "FastAPI POST `deprecate_policy` without auth dependency \u2014 src/agentic_os/api.py:2166"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-df3d0f32ddf8c9ce", "name": "FastAPI POST `undeprecate_policy` without auth dependency \u2014 src/agentic_os/api.py:2193", "shortDescription": {"text": "FastAPI POST `undeprecate_policy` without auth dependency \u2014 src/agentic_os/api.py:2193"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1413d416f383fcf9", "name": "FastAPI POST `catalog_surfaces_patch` without auth dependency \u2014 src/agentic_os/api.py:2326", "shortDescription": {"text": "FastAPI POST `catalog_surfaces_patch` without auth dependency \u2014 src/agentic_os/api.py:2326"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bd7be5421806ef44", "name": "FastAPI POST `patches_rollback` without auth dependency \u2014 src/agentic_os/api.py:2403", "shortDescription": {"text": "FastAPI POST `patches_rollback` without auth dependency \u2014 src/agentic_os/api.py:2403"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4e4e5a808081ff9e", "name": "FastAPI POST `registry_upsert_agent` without auth dependency \u2014 src/agentic_os/api.py:2474", "shortDescription": {"text": "FastAPI POST `registry_upsert_agent` without auth dependency \u2014 src/agentic_os/api.py:2474"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f28fda55f5f3e0c0", "name": "FastAPI POST `registry_disable_agent` without auth dependency \u2014 src/agentic_os/api.py:2492", "shortDescription": {"text": "FastAPI POST `registry_disable_agent` without auth dependency \u2014 src/agentic_os/api.py:2492"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-47e74cae787b911b", "name": "FastAPI POST `config_patch_endpoint` without auth dependency \u2014 src/agentic_os/api.py:2545", "shortDescription": {"text": "FastAPI POST `config_patch_endpoint` without auth dependency \u2014 src/agentic_os/api.py:2545"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-98dfdcf8354db20d", "name": "FastAPI POST `harness_config_patch_endpoint` without auth dependency \u2014 src/agentic_os/api.py:2656", "shortDescription": {"text": "FastAPI POST `harness_config_patch_endpoint` without auth dependency \u2014 src/agentic_os/api.py:2656"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-47fa58e020bba3a6", "name": "FastAPI POST `fleet_probe` without auth dependency \u2014 src/agentic_os/api.py:2759", "shortDescription": {"text": "FastAPI POST `fleet_probe` without auth dependency \u2014 src/agentic_os/api.py:2759"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-917c59649bb687d6", "name": "FastAPI POST `setup_import` without auth dependency \u2014 src/agentic_os/api.py:3166", "shortDescription": {"text": "FastAPI POST `setup_import` without auth dependency \u2014 src/agentic_os/api.py:3166"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3b3984659250286e", "name": "FastAPI POST `upsert_workspace` without auth dependency \u2014 src/agentic_os/api.py:3197", "shortDescription": {"text": "FastAPI POST `upsert_workspace` without auth dependency \u2014 src/agentic_os/api.py:3197"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b4e2204956d8fe91", "name": "FastAPI PUT `set_active_workspace` without auth dependency \u2014 src/agentic_os/api.py:3210", "shortDescription": {"text": "FastAPI PUT `set_active_workspace` without auth dependency \u2014 src/agentic_os/api.py:3210"}, "fullDescription": {"text": "`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-41a557e81296c925", "name": "FastAPI POST `create_run_template` without auth dependency \u2014 src/agentic_os/api.py:3285", "shortDescription": {"text": "FastAPI POST `create_run_template` without auth dependency \u2014 src/agentic_os/api.py:3285"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6bafe07a56a6cd89", "name": "FastAPI PUT `update_run_template` without auth dependency \u2014 src/agentic_os/api.py:3294", "shortDescription": {"text": "FastAPI PUT `update_run_template` without auth dependency \u2014 src/agentic_os/api.py:3294"}, "fullDescription": {"text": "`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-997b826a9b3b0096", "name": "FastAPI DELETE `delete_run_template` without auth dependency \u2014 src/agentic_os/api.py:3309", "shortDescription": {"text": "FastAPI DELETE `delete_run_template` without auth dependency \u2014 src/agentic_os/api.py:3309"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5fcac2870a1bb304", "name": "FastAPI POST `remote_pairing_start` without auth dependency \u2014 src/agentic_os/remote_api.py:50", "shortDescription": {"text": "FastAPI POST `remote_pairing_start` without auth dependency \u2014 src/agentic_os/remote_api.py:50"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-38bdb500be165485", "name": "FastAPI POST `remote_pairing_complete` without auth dependency \u2014 src/agentic_os/remote_api.py:55", "shortDescription": {"text": "FastAPI POST `remote_pairing_complete` without auth dependency \u2014 src/agentic_os/remote_api.py:55"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-01e6995c222a504b", "name": "FastAPI DELETE `remote_revoke_device` without auth dependency \u2014 src/agentic_os/remote_api.py:80", "shortDescription": {"text": "FastAPI DELETE `remote_revoke_device` without auth dependency \u2014 src/agentic_os/remote_api.py:80"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3140e61d7cac5091", "name": "Unused endpoint: GET /agents", "shortDescription": {"text": "Unused endpoint: GET /agents"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `GET /agents` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b30cbdd177c13681", "name": "Unused endpoint: GET /agents/{agent_id}", "shortDescription": {"text": "Unused endpoint: GET /agents/{agent_id}"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `GET /agents/{agent_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bb69a57a408f493f", "name": "Unused endpoint: GET /harnesses", "shortDescription": {"text": "Unused endpoint: GET /harnesses"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `GET /harnesses` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5f7c48f4030788e1", "name": "Unused endpoint: GET /harnesses/validate", "shortDescription": {"text": "Unused endpoint: GET /harnesses/validate"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `GET /harnesses/validate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3e9fe4a179ed2a55", "name": "Unused endpoint: GET /harnesses/{harness_id}", "shortDescription": {"text": "Unused endpoint: GET /harnesses/{harness_id}"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `GET /harnesses/{harness_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ad31945874b2029c", "name": "Unused endpoint: GET /tools/discovery", "shortDescription": {"text": "Unused endpoint: GET /tools/discovery"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `GET /tools/discovery` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7cc2ea984201809f", "name": "Unused endpoint: GET /tools/inventory", "shortDescription": {"text": "Unused endpoint: GET /tools/inventory"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `GET /tools/inventory` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-332633fde5ad391d", "name": "Unused endpoint: GET /tools/capabilities", "shortDescription": {"text": "Unused endpoint: GET /tools/capabilities"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `GET /tools/capabilities` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5262e871a1d14661", "name": "Unused endpoint: GET /tools/mcp/matrix", "shortDescription": {"text": "Unused endpoint: GET /tools/mcp/matrix"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `GET /tools/mcp/matrix` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1429ecab8793e2c7", "name": "Unused endpoint: POST /tools/mcp/copy", "shortDescription": {"text": "Unused endpoint: POST /tools/mcp/copy"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `POST /tools/mcp/copy` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bd6a3f93d7715265", "name": "Unused endpoint: POST /tools/mcp/remove", "shortDescription": {"text": "Unused endpoint: POST /tools/mcp/remove"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `POST /tools/mcp/remove` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1838d1f7443800dd", "name": "Unused endpoint: GET /agentic/inventory", "shortDescription": {"text": "Unused endpoint: GET /agentic/inventory"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `GET /agentic/inventory` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7e1d38751f4805f1", "name": "Unused endpoint: GET /agentic/inventory/{agent_id}", "shortDescription": {"text": "Unused endpoint: GET /agentic/inventory/{agent_id}"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `GET /agentic/inventory/{agent_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ff79ac09a7c292db", "name": "Unused endpoint: GET /harness-contracts", "shortDescription": {"text": "Unused endpoint: GET /harness-contracts"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `GET /harness-contracts` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-09e933952e16a392", "name": "Unused endpoint: GET /harness-contracts/{harness_id}", "shortDescription": {"text": "Unused endpoint: GET /harness-contracts/{harness_id}"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `GET /harness-contracts/{harness_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f5bfd1bf5febca98", "name": "Unused endpoint: GET /harnesses/{harness_id}/health", "shortDescription": {"text": "Unused endpoint: GET /harnesses/{harness_id}/health"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `GET /harnesses/{harness_id}/health` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-871a43f365feafdb", "name": "Unused endpoint: GET /harnesses/{harness_id}/logs", "shortDescription": {"text": "Unused endpoint: GET /harnesses/{harness_id}/logs"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `GET /harnesses/{harness_id}/logs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6d9534131ed7ca41", "name": "Unused endpoint: GET /profiles", "shortDescription": {"text": "Unused endpoint: GET /profiles"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `GET /profiles` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fca12bb7973e4455", "name": "Unused endpoint: GET /profiles/{name}", "shortDescription": {"text": "Unused endpoint: GET /profiles/{name}"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `GET /profiles/{name}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-40e097e28351ead4", "name": "Unused endpoint: POST /profiles", "shortDescription": {"text": "Unused endpoint: POST /profiles"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `POST /profiles` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-defef74db2536e83", "name": "Unused endpoint: DELETE /profiles/{name}", "shortDescription": {"text": "Unused endpoint: DELETE /profiles/{name}"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `DELETE /profiles/{name}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f1e9e302b997df28", "name": "Unused endpoint: GET /profiles/{name}/diff", "shortDescription": {"text": "Unused endpoint: GET /profiles/{name}/diff"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `GET /profiles/{name}/diff` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f041bb78464fde32", "name": "Unused endpoint: POST /projects/{project_path:path}/bind-profile", "shortDescription": {"text": "Unused endpoint: POST /projects/{project_path:path}/bind-profile"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `POST /projects/{project_path:path}/bind-profile` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-58e1ae5124a8deac", "name": "Unused endpoint: GET /usage/sessions/{session_id}", "shortDescription": {"text": "Unused endpoint: GET /usage/sessions/{session_id}"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `GET /usage/sessions/{session_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7b00dac7e0df6020", "name": "Unused endpoint: GET /usage/summary", "shortDescription": {"text": "Unused endpoint: GET /usage/summary"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `GET /usage/summary` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1e408081e66c2c1a", "name": "Unused endpoint: GET /usage/quotas", "shortDescription": {"text": "Unused endpoint: GET /usage/quotas"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `GET /usage/quotas` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-86bb0788a0171ec1", "name": "Unused endpoint: GET /harnesses/{harness_id}/activity", "shortDescription": {"text": "Unused endpoint: GET /harnesses/{harness_id}/activity"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `GET /harnesses/{harness_id}/activity` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-92efb2dc9205e7a4", "name": "Unused endpoint: POST /sessions", "shortDescription": {"text": "Unused endpoint: POST /sessions"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `POST /sessions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b15d518d538de57d", "name": "Unused endpoint: GET /sessions", "shortDescription": {"text": "Unused endpoint: GET /sessions"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `GET /sessions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f888b34adc3b3ce5", "name": "Unused endpoint: GET /sessions/live", "shortDescription": {"text": "Unused endpoint: GET /sessions/live"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `GET /sessions/live` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-45bd216e24f0b25c", "name": "Unused endpoint: GET /sessions/live/transcript", "shortDescription": {"text": "Unused endpoint: GET /sessions/live/transcript"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `GET /sessions/live/transcript` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-869c0c3d4664fe18", "name": "Unused endpoint: POST /sessions/live/open-terminal", "shortDescription": {"text": "Unused endpoint: POST /sessions/live/open-terminal"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `POST /sessions/live/open-terminal` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-41c23ec3b2c0e166", "name": "Unused endpoint: GET /sessions/{session_id}", "shortDescription": {"text": "Unused endpoint: GET /sessions/{session_id}"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `GET /sessions/{session_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-61b18eea0e4429ad", "name": "Unused endpoint: GET /sessions/{session_id}/events", "shortDescription": {"text": "Unused endpoint: GET /sessions/{session_id}/events"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `GET /sessions/{session_id}/events` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0f21fadaca1b7c37", "name": "Unused endpoint: GET /sessions/{session_id}/evidence", "shortDescription": {"text": "Unused endpoint: GET /sessions/{session_id}/evidence"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `GET /sessions/{session_id}/evidence` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-caaab95d934bd808", "name": "Unused endpoint: GET /sessions/{session_id}/evidence.zip", "shortDescription": {"text": "Unused endpoint: GET /sessions/{session_id}/evidence.zip"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `GET /sessions/{session_id}/evidence.zip` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-182953fc9b17126e", "name": "Unused endpoint: GET /sessions/{session_id}/evidence/events", "shortDescription": {"text": "Unused endpoint: GET /sessions/{session_id}/evidence/events"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `GET /sessions/{session_id}/evidence/events` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1e65e7bc1cd95cc9", "name": "Unused endpoint: GET /sessions/{session_id}/timeline", "shortDescription": {"text": "Unused endpoint: GET /sessions/{session_id}/timeline"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `GET /sessions/{session_id}/timeline` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a2f636dccf9bb44e", "name": "Unused endpoint: GET /sessions/{session_id}/logs", "shortDescription": {"text": "Unused endpoint: GET /sessions/{session_id}/logs"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `GET /sessions/{session_id}/logs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be77127b2cba4584", "name": "Unused endpoint: POST /sessions/discover", "shortDescription": {"text": "Unused endpoint: POST /sessions/discover"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `POST /sessions/discover` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4d291b4883296b4a", "name": "Unused endpoint: POST /sessions/bind", "shortDescription": {"text": "Unused endpoint: POST /sessions/bind"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `POST /sessions/bind` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ec1a2c4745eabaa", "name": "Unused endpoint: POST /sessions/{session_id}/stop", "shortDescription": {"text": "Unused endpoint: POST /sessions/{session_id}/stop"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `POST /sessions/{session_id}/stop` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-27acb544e56dfc63", "name": "Unused endpoint: POST /sessions/{session_id}/retry", "shortDescription": {"text": "Unused endpoint: POST /sessions/{session_id}/retry"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `POST /sessions/{session_id}/retry` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f4919c72ac3638ba", "name": "Unused endpoint: POST /sessions/{session_id}/attach", "shortDescription": {"text": "Unused endpoint: POST /sessions/{session_id}/attach"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `POST /sessions/{session_id}/attach` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0518558dda792269", "name": "Unused endpoint: GET /approvals", "shortDescription": {"text": "Unused endpoint: GET /approvals"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `GET /approvals` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0a39229a0ad70788", "name": "Unused endpoint: GET /approvals/{approval_id}", "shortDescription": {"text": "Unused endpoint: GET /approvals/{approval_id}"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `GET /approvals/{approval_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f49badd3acf667c7", "name": "Unused endpoint: POST /approvals/{approval_id}/approve", "shortDescription": {"text": "Unused endpoint: POST /approvals/{approval_id}/approve"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `POST /approvals/{approval_id}/approve` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-786daf29276dda73", "name": "Unused endpoint: POST /approvals/{approval_id}/reject", "shortDescription": {"text": "Unused endpoint: POST /approvals/{approval_id}/reject"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `POST /approvals/{approval_id}/reject` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-173ee7fc8170db55", "name": "Unused endpoint: POST /sessions/{session_id}/memory/summary", "shortDescription": {"text": "Unused endpoint: POST /sessions/{session_id}/memory/summary"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `POST /sessions/{session_id}/memory/summary` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bdbc1503ae53d98b", "name": "Unused endpoint: GET /sessions/{session_id}/memory/summary", "shortDescription": {"text": "Unused endpoint: GET /sessions/{session_id}/memory/summary"}, "fullDescription": {"text": "`src/agentic_os/api.py` declares `GET /sessions/{session_id}/memory/summary` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/22575"}, "properties": {"repository": "WaynezProg/agentic-os", "repoUrl": "https://github.com/WaynezProg/agentic-os", "branch": "main"}, "results": [{"ruleId": "scanner-a19910a272730878", "level": "note", "message": {"text": "Possibly dead Python function: load_registry_document"}, "properties": {"repobilityId": "214a1f2a33cb1d90", "scanner": "scanner-primary", "fingerprint": "a19910a272730878", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/registry.py:140"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1d058db4cb962f60", "level": "note", "message": {"text": "Possibly dead Python function: decorator"}, "properties": {"repobilityId": "ffbcbc9bc189af1c", "scanner": "scanner-primary", "fingerprint": "1d058db4cb962f60", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/config_inventory.py:35"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0c308910b29ecf22", "level": "note", "message": {"text": "Possibly dead Python function: read_inventory"}, "properties": {"repobilityId": "89236bb9de7623a0", "scanner": "scanner-primary", "fingerprint": "0c308910b29ecf22", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/config_inventory.py:263"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fea958835e4af043", "level": "note", "message": {"text": "Possibly dead Python function: list_for_harnesses"}, "properties": {"repobilityId": "4e25133d574a816c", "scanner": "scanner-primary", "fingerprint": "fea958835e4af043", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/usage.py:414"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d75f44fb288b870e", "level": "note", "message": {"text": "Possibly dead Python function: require_remote_bearer"}, "properties": {"repobilityId": "1888d3640df169db", "scanner": "scanner-primary", "fingerprint": "d75f44fb288b870e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/remote_api.py:37"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-3724f783c216dc59", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/app.js:293"}, "properties": {"repobilityId": "bfb541b11118ec0a", "scanner": "scanner-primary", "fingerprint": "3724f783c216dc59", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/app.js"}, "region": {"startLine": 293}}}]}, {"ruleId": "scanner-c80f7f46cd0ffe43", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/approval-workbench.js:89"}, "properties": {"repobilityId": "8e8c09475cf6999e", "scanner": "scanner-primary", "fingerprint": "c80f7f46cd0ffe43", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/ui/approval-workbench.js"}, "region": {"startLine": 89}}}]}, {"ruleId": "scanner-1821734c1acb5485", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/vibe-coding-launcher.js:72"}, "properties": {"repobilityId": "13626ccbf93b124e", "scanner": "scanner-primary", "fingerprint": "1821734c1acb5485", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/ui/vibe-coding-launcher.js"}, "region": {"startLine": 72}}}]}, {"ruleId": "scanner-944228efef5b15c2", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/control-plane-editor.js:58"}, "properties": {"repobilityId": "d697eb87e4bfc9e1", "scanner": "scanner-primary", "fingerprint": "944228efef5b15c2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/ui/control-plane-editor.js"}, "region": {"startLine": 58}}}]}, {"ruleId": "scanner-13a6e84806231ab0", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/remote-console.js:117"}, "properties": {"repobilityId": "09430e8827b1d270", "scanner": "scanner-primary", "fingerprint": "13a6e84806231ab0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/ui/remote-console.js"}, "region": {"startLine": 117}}}]}, {"ruleId": "scanner-34a36bf8d6ac24dc", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/config-editor.js:99"}, "properties": {"repobilityId": "e05073b2fc4b601b", "scanner": "scanner-primary", "fingerprint": "34a36bf8d6ac24dc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/ui/config-editor.js"}, "region": {"startLine": 99}}}]}, {"ruleId": "scanner-08c360e2f41d65f6", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/chat-launcher.js:166"}, "properties": {"repobilityId": "338e93439ef494ce", "scanner": "scanner-primary", "fingerprint": "08c360e2f41d65f6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/ui/chat-launcher.js"}, "region": {"startLine": 166}}}]}, {"ruleId": "scanner-d675be9f12f14571", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/catalog-editor.js:218"}, "properties": {"repobilityId": "1421192d29914ebd", "scanner": "scanner-primary", "fingerprint": "d675be9f12f14571", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/ui/catalog-editor.js"}, "region": {"startLine": 218}}}]}, {"ruleId": "scanner-4b02b62bd4dd0320", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/workspace-manager.js:55"}, "properties": {"repobilityId": "539e883f79cc329c", "scanner": "scanner-primary", "fingerprint": "4b02b62bd4dd0320", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/ui/workspace-manager.js"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-14a182de47f697e9", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/tool-discovery.js:165"}, "properties": {"repobilityId": "17852d199b626e67", "scanner": "scanner-primary", "fingerprint": "14a182de47f697e9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/ui/tool-discovery.js"}, "region": {"startLine": 165}}}]}, {"ruleId": "scanner-2964f1e7ebd82c18", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/registry-editor.js:66"}, "properties": {"repobilityId": "e1f260279dfbe9c2", "scanner": "scanner-primary", "fingerprint": "2964f1e7ebd82c18", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/ui/registry-editor.js"}, "region": {"startLine": 66}}}]}, {"ruleId": "scanner-23f12c77701e59a4", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/rollback.js:24"}, "properties": {"repobilityId": "8657e97053649816", "scanner": "scanner-primary", "fingerprint": "23f12c77701e59a4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/ui/rollback.js"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-fb3523830e5f23d2", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/profile-editor.js:79"}, "properties": {"repobilityId": "b30330dc546e70dc", "scanner": "scanner-primary", "fingerprint": "fb3523830e5f23d2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/ui/profile-editor.js"}, "region": {"startLine": 79}}}]}, {"ruleId": "scanner-31ae370b192d7259", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/discover-bind.js:48"}, "properties": {"repobilityId": "27c9c899fd4911bd", "scanner": "scanner-primary", "fingerprint": "31ae370b192d7259", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/ui/discover-bind.js"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-f249d8465ae75518", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/provider-switchboard.js:118"}, "properties": {"repobilityId": "0af7a18222c03b1f", "scanner": "scanner-primary", "fingerprint": "f249d8465ae75518", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/ui/provider-switchboard.js"}, "region": {"startLine": 118}}}]}, {"ruleId": "scanner-6775585c6a3a33f4", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/daily-dashboard.js:50"}, "properties": {"repobilityId": "c9307c4a1598270e", "scanner": "scanner-primary", "fingerprint": "6775585c6a3a33f4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/ui/daily-dashboard.js"}, "region": {"startLine": 50}}}]}, {"ruleId": "scanner-1d2146a84b496856", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/dashboard-v2.js:115"}, "properties": {"repobilityId": "34f60f9a45a213fb", "scanner": "scanner-primary", "fingerprint": "1d2146a84b496856", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/ui/dashboard-v2.js"}, "region": {"startLine": 115}}}]}, {"ruleId": "scanner-abe305d73d5dbbd4", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in apps/web/ui/agentic-inventory.js:86"}, "properties": {"repobilityId": "4fe2accdf994e5bd", "scanner": "scanner-primary", "fingerprint": "abe305d73d5dbbd4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/ui/agentic-inventory.js"}, "region": {"startLine": 86}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-8ec2176153fa3156", "level": "note", "message": {"text": "Very large file: tests/test_cli.py (2391 lines)"}, "properties": {"repobilityId": "2121c5b297f0116c", "scanner": "scanner-primary", "fingerprint": "8ec2176153fa3156", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-c0694227f9f24cff", "level": "note", "message": {"text": "Very large file: tests/test_api.py (3184 lines)"}, "properties": {"repobilityId": "7a0c2cfd494d55be", "scanner": "scanner-primary", "fingerprint": "c0694227f9f24cff", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-1d458bd2f4806cce", "level": "note", "message": {"text": "Very large file: apps/web/app.js (1490 lines)"}, "properties": {"repobilityId": "30b2032f690baa94", "scanner": "scanner-primary", "fingerprint": "1d458bd2f4806cce", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ba3ca86083124d21", "level": "note", "message": {"text": "Very large file: src/agentic_os/api.py (3523 lines)"}, "properties": {"repobilityId": "707e320bc8ae85f6", "scanner": "scanner-primary", "fingerprint": "ba3ca86083124d21", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ebdddf2b3d584c13", "level": "note", "message": {"text": "Very large file: src/agentic_os/control_plane.py (1594 lines)"}, "properties": {"repobilityId": "7ce2cf137025d313", "scanner": "scanner-primary", "fingerprint": "ebdddf2b3d584c13", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "eb8a3e9944a9b508", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-d57b3f82d2270c5b", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/desktop/package.json"}, "properties": {"repobilityId": "a5d1a254ecc349f8", "scanner": "scanner-primary", "fingerprint": "d57b3f82d2270c5b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/desktop/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "fbd867ba56f989d3", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "6e6a2c6666bff095", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "eaaecf2b9dfed078", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "19b61f7f80c4fec1", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "11e37261a209ee00", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-e725d2ab884fbd49", "level": "note", "message": {"text": "Multiple root agent instruction files without precedence"}, "properties": {"repobilityId": "1953db6c89508d22", "scanner": "scanner-primary", "fingerprint": "e725d2ab884fbd49", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["agent-instructions", "governance"]}}, {"ruleId": "scanner-a416be3f6518c530", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in tests/test_storage.py:128"}, "properties": {"repobilityId": "4a3eb27abcf14a97", "scanner": "scanner-primary", "fingerprint": "a416be3f6518c530", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-8ca86f990e2ead7e", "level": "note", "message": {"text": "Legacy-named symbol `contract_from_agent_v2` in tests/test_adapter_contract.py:11"}, "properties": {"repobilityId": "5962e96b23e25ab9", "scanner": "scanner-primary", "fingerprint": "8ca86f990e2ead7e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-574bea7e8f73966c", "level": "note", "message": {"text": "Legacy-named symbol `test_upsert_skill_creates_file_with_sidecar_backup` in tests/test_safe_edit.py:74"}, "properties": {"repobilityId": "468e2df0386a8d03", "scanner": "scanner-primary", "fingerprint": "574bea7e8f73966c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-31aa9d31c6cdbcef", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/test_registry.py:103"}, "properties": {"repobilityId": "739f4132b66b9974", "scanner": "scanner-primary", "fingerprint": "31aa9d31c6cdbcef", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ee30df0508e6a02f", "level": "note", "message": {"text": "Legacy-named symbol `test_skill_can_be_deprecated_and_upsert_resets_deprecated` in tests/test_control_plane.py:344"}, "properties": {"repobilityId": "3fd19522d1701b98", "scanner": "scanner-primary", "fingerprint": "ee30df0508e6a02f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-155da53a519fd303", "level": "note", "message": {"text": "Legacy-named symbol `mcp_copy` in tests/test_cli.py:117"}, "properties": {"repobilityId": "a8e0d6e9be213449", "scanner": "scanner-primary", "fingerprint": "155da53a519fd303", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-32c579d69f08de83", "level": "note", "message": {"text": "Legacy-named symbol `skill_deprecated` in tests/test_api.py:934"}, "properties": {"repobilityId": "e94a2a19a6fc4954", "scanner": "scanner-primary", "fingerprint": "32c579d69f08de83", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-b8ab2dece5b3067e", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/web/api.js:183"}, "properties": {"repobilityId": "e37a27e69d8eb9d4", "scanner": "scanner-primary", "fingerprint": "b8ab2dece5b3067e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-dba4f1d3e623b7a2", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/web/ui/product-polish.js:76"}, "properties": {"repobilityId": "33bea0b2fe1ef335", "scanner": "scanner-primary", "fingerprint": "dba4f1d3e623b7a2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-aa7c9851055da3b5", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 src/agentic_os/evidence.py:339"}, "properties": {"repobilityId": "35460c870254c696", "scanner": "scanner-primary", "fingerprint": "aa7c9851055da3b5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-65872985bb6c3923", "level": "note", "message": {"text": "Legacy-named symbol `mcp_copy` in src/agentic_os/client.py:53"}, "properties": {"repobilityId": "24507651e99d15ed", "scanner": "scanner-primary", "fingerprint": "65872985bb6c3923", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-23a736395f69a417", "level": "note", "message": {"text": "Legacy-named symbol `would_backup` in src/agentic_os/safe_edit.py:104"}, "properties": {"repobilityId": "cba4405eea673300", "scanner": "scanner-primary", "fingerprint": "23a736395f69a417", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-b5b885fe3c07f7a7", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in src/agentic_os/registry.py:170"}, "properties": {"repobilityId": "6e2d85a9e0274de8", "scanner": "scanner-primary", "fingerprint": "b5b885fe3c07f7a7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-ae40fadde065f7da", "level": "note", "message": {"text": "Legacy-named symbol `contract_from_agent_v2` in src/agentic_os/adapter_contract.py:179"}, "properties": {"repobilityId": "b3b1c76fa3fce049", "scanner": "scanner-primary", "fingerprint": "ae40fadde065f7da", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-ebfc3b76c5783d75", "level": "note", "message": {"text": "Stub function `main` (body is just `pass`/`return`) \u2014 src/agentic_os/daemon.py:18"}, "properties": {"repobilityId": "c8a4405d6368856f", "scanner": "scanner-primary", "fingerprint": "ebfc3b76c5783d75", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-639cd424e93f0e8a", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in src/agentic_os/logs.py:140"}, "properties": {"repobilityId": "04cc2e944fcd524c", "scanner": "scanner-primary", "fingerprint": "639cd424e93f0e8a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-6e677361d064c040", "level": "note", "message": {"text": "Legacy-named symbol `tools_mcp_copy` in src/agentic_os/cli.py:361"}, "properties": {"repobilityId": "59c3a04d7fc9e9ca", "scanner": "scanner-primary", "fingerprint": "6e677361d064c040", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-7427683ec0705bb8", "level": "note", "message": {"text": "Legacy-named symbol `contract_from_agent_v2` in src/agentic_os/api.py:78"}, "properties": {"repobilityId": "d9113b4101c0984b", "scanner": "scanner-primary", "fingerprint": "7427683ec0705bb8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-8a570570c803bac1", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 src/agentic_os/api.py:1563"}, "properties": {"repobilityId": "5a99d99344d5e3a4", "scanner": "scanner-primary", "fingerprint": "8a570570c803bac1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "f89a0f294a9b14b1", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "636ff9038dd6767e", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "e7ccdca8dcf41f53", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "d0bc528388ebdd03", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "f92896725ee75eda", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "cc415ef5ce00c9a3", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "c30d4cddb36c0b51", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "fa43fcd07324c571", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "b1e0a7bd4db9d5bb", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "fdeac8483cb60582", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "bed31eea6148990a", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "75e4c0621b424f64", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "0aaf29d8b986cfbb", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "b39fce373b080638", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "be3eb5f0d6c4f59a", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "c23608684de0cae6", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "2440bd0a93ad79cd", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "da3a65863a32cc22", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "622bee03eb8549a0", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "bf99549d23cb9a0d", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-dddb0126b6c7a951", "level": "error", "message": {"text": "FastAPI POST `mcp_copy` without auth dependency \u2014 src/agentic_os/api.py:534"}, "properties": {"repobilityId": "f1dab59019e74b4f", "scanner": "scanner-primary", "fingerprint": "dddb0126b6c7a951", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 534}}}]}, {"ruleId": "scanner-8b2f9ad8eadb912a", "level": "error", "message": {"text": "FastAPI POST `mcp_remove` without auth dependency \u2014 src/agentic_os/api.py:568"}, "properties": {"repobilityId": "732c8b781f4bdb85", "scanner": "scanner-primary", "fingerprint": "8b2f9ad8eadb912a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 568}}}]}, {"ruleId": "scanner-694034f9a1a6e33c", "level": "error", "message": {"text": "FastAPI POST `upsert_profile` without auth dependency \u2014 src/agentic_os/api.py:740"}, "properties": {"repobilityId": "945c6d2c76de9f4f", "scanner": "scanner-primary", "fingerprint": "694034f9a1a6e33c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 740}}}]}, {"ruleId": "scanner-cf6c2552dc39240d", "level": "error", "message": {"text": "FastAPI DELETE `delete_profile` without auth dependency \u2014 src/agentic_os/api.py:768"}, "properties": {"repobilityId": "5b04e0eef2913559", "scanner": "scanner-primary", "fingerprint": "cf6c2552dc39240d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 768}}}]}, {"ruleId": "scanner-aacfd945bca66e34", "level": "error", "message": {"text": "FastAPI POST `bind_project_profile` without auth dependency \u2014 src/agentic_os/api.py:825"}, "properties": {"repobilityId": "a9f6a40ca2912db4", "scanner": "scanner-primary", "fingerprint": "aacfd945bca66e34", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 825}}}]}, {"ruleId": "scanner-016ec28ee0d9e3ff", "level": "error", "message": {"text": "FastAPI POST `run_session` without auth dependency \u2014 src/agentic_os/api.py:989"}, "properties": {"repobilityId": "fc9b34dfbdfb20f5", "scanner": "scanner-primary", "fingerprint": "016ec28ee0d9e3ff", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 989}}}]}, {"ruleId": "scanner-524bc536af8f7918", "level": "error", "message": {"text": "FastAPI POST `sessions_discover` without auth dependency \u2014 src/agentic_os/api.py:1319"}, "properties": {"repobilityId": "8f2cd835ca1ccd34", "scanner": "scanner-primary", "fingerprint": "524bc536af8f7918", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 1319}}}]}, {"ruleId": "scanner-74887be41480f640", "level": "error", "message": {"text": "FastAPI POST `sessions_bind` without auth dependency \u2014 src/agentic_os/api.py:1346"}, "properties": {"repobilityId": "da16e61f9b3385a2", "scanner": "scanner-primary", "fingerprint": "74887be41480f640", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 1346}}}]}, {"ruleId": "scanner-f40336e2d90c4948", "level": "error", "message": {"text": "FastAPI POST `stop_session` without auth dependency \u2014 src/agentic_os/api.py:1414"}, "properties": {"repobilityId": "e45d445462fe5f4e", "scanner": "scanner-primary", "fingerprint": "f40336e2d90c4948", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 1414}}}]}, {"ruleId": "scanner-53b3603238ebf765", "level": "error", "message": {"text": "FastAPI POST `retry_session` without auth dependency \u2014 src/agentic_os/api.py:1423"}, "properties": {"repobilityId": "083d151edfe4c818", "scanner": "scanner-primary", "fingerprint": "53b3603238ebf765", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 1423}}}]}, {"ruleId": "scanner-33946877ba69fb76", "level": "error", "message": {"text": "FastAPI POST `attach_session` without auth dependency \u2014 src/agentic_os/api.py:1511"}, "properties": {"repobilityId": "4a251abe9cf74bdb", "scanner": "scanner-primary", "fingerprint": "33946877ba69fb76", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 1511}}}]}, {"ruleId": "scanner-0ad3e108a881ea54", "level": "error", "message": {"text": "FastAPI POST `approve_approval` without auth dependency \u2014 src/agentic_os/api.py:1601"}, "properties": {"repobilityId": "ee7a9d4df7b8c35f", "scanner": "scanner-primary", "fingerprint": "0ad3e108a881ea54", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 1601}}}]}, {"ruleId": "scanner-704f8dcdf66a8a86", "level": "error", "message": {"text": "FastAPI POST `reject_approval` without auth dependency \u2014 src/agentic_os/api.py:1698"}, "properties": {"repobilityId": "be41a4397a959130", "scanner": "scanner-primary", "fingerprint": "704f8dcdf66a8a86", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 1698}}}]}, {"ruleId": "scanner-f02f0823d5fdaf8c", "level": "error", "message": {"text": "FastAPI POST `create_session_memory_summary` without auth dependency \u2014 src/agentic_os/api.py:1725"}, "properties": {"repobilityId": "c525c32fa9b2296a", "scanner": "scanner-primary", "fingerprint": "f02f0823d5fdaf8c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 1725}}}]}, {"ruleId": "scanner-3c063e3d1f2e215d", "level": "error", "message": {"text": "FastAPI POST `create_session_memory_review` without auth dependency \u2014 src/agentic_os/api.py:1743"}, "properties": {"repobilityId": "7d343dc83e0bee28", "scanner": "scanner-primary", "fingerprint": "3c063e3d1f2e215d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 1743}}}]}, {"ruleId": "scanner-ee448becb3fcbf4d", "level": "error", "message": {"text": "FastAPI POST `approve_memory_review` without auth dependency \u2014 src/agentic_os/api.py:1755"}, "properties": {"repobilityId": "10ac426f00b71260", "scanner": "scanner-primary", "fingerprint": "ee448becb3fcbf4d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 1755}}}]}, {"ruleId": "scanner-a7f35344319b9b79", "level": "error", "message": {"text": "FastAPI POST `reject_memory_review` without auth dependency \u2014 src/agentic_os/api.py:1764"}, "properties": {"repobilityId": "337fd1ebebb7a9a7", "scanner": "scanner-primary", "fingerprint": "a7f35344319b9b79", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 1764}}}]}, {"ruleId": "scanner-659def1f81c9529d", "level": "error", "message": {"text": "FastAPI POST `upsert_skill` without auth dependency \u2014 src/agentic_os/api.py:1796"}, "properties": {"repobilityId": "1639cd6e0ac162fb", "scanner": "scanner-primary", "fingerprint": "659def1f81c9529d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 1796}}}]}, {"ruleId": "scanner-7915e1c8ae3c4963", "level": "error", "message": {"text": "FastAPI POST `skill_rollback` without auth dependency \u2014 src/agentic_os/api.py:1837"}, "properties": {"repobilityId": "320412978b02e875", "scanner": "scanner-primary", "fingerprint": "7915e1c8ae3c4963", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 1837}}}]}, {"ruleId": "scanner-e15b6d6b0fd52a7b", "level": "error", "message": {"text": "FastAPI POST `disable_skill` without auth dependency \u2014 src/agentic_os/api.py:1861"}, "properties": {"repobilityId": "f8393030d3004e05", "scanner": "scanner-primary", "fingerprint": "e15b6d6b0fd52a7b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 1861}}}]}, {"ruleId": "scanner-365408aaaee2d3ea", "level": "error", "message": {"text": "FastAPI POST `deprecate_skill` without auth dependency \u2014 src/agentic_os/api.py:1876"}, "properties": {"repobilityId": "a3041229d2d77057", "scanner": "scanner-primary", "fingerprint": "365408aaaee2d3ea", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 1876}}}]}, {"ruleId": "scanner-272e0004d9ad51cf", "level": "error", "message": {"text": "FastAPI POST `undeprecate_skill` without auth dependency \u2014 src/agentic_os/api.py:1903"}, "properties": {"repobilityId": "90dd7d7a1dd5c544", "scanner": "scanner-primary", "fingerprint": "272e0004d9ad51cf", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 1903}}}]}, {"ruleId": "scanner-e53975fbcb24d9e5", "level": "error", "message": {"text": "FastAPI POST `upsert_mcp_server` without auth dependency \u2014 src/agentic_os/api.py:1937"}, "properties": {"repobilityId": "341d95379f3897ca", "scanner": "scanner-primary", "fingerprint": "e53975fbcb24d9e5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 1937}}}]}, {"ruleId": "scanner-fb524d2504d81b15", "level": "error", "message": {"text": "FastAPI POST `mcp_rollback` without auth dependency \u2014 src/agentic_os/api.py:1979"}, "properties": {"repobilityId": "73ffb98607b7c7a7", "scanner": "scanner-primary", "fingerprint": "fb524d2504d81b15", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 1979}}}]}, {"ruleId": "scanner-49059ec19f21f7fc", "level": "error", "message": {"text": "FastAPI POST `disable_mcp_server` without auth dependency \u2014 src/agentic_os/api.py:2003"}, "properties": {"repobilityId": "e327556dbd5d4e42", "scanner": "scanner-primary", "fingerprint": "49059ec19f21f7fc", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 2003}}}]}, {"ruleId": "scanner-26c672aeeb040488", "level": "error", "message": {"text": "FastAPI POST `deprecate_mcp_server` without auth dependency \u2014 src/agentic_os/api.py:2018"}, "properties": {"repobilityId": "f288d2b5e7d7a3af", "scanner": "scanner-primary", "fingerprint": "26c672aeeb040488", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 2018}}}]}, {"ruleId": "scanner-8ddff2c792142fb7", "level": "error", "message": {"text": "FastAPI POST `undeprecate_mcp_server` without auth dependency \u2014 src/agentic_os/api.py:2045"}, "properties": {"repobilityId": "f275cc8cac6a2908", "scanner": "scanner-primary", "fingerprint": "8ddff2c792142fb7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 2045}}}]}, {"ruleId": "scanner-ea508bada721ded7", "level": "error", "message": {"text": "FastAPI POST `evaluate_policy` without auth dependency \u2014 src/agentic_os/api.py:2069"}, "properties": {"repobilityId": "4dafd74eed8c4864", "scanner": "scanner-primary", "fingerprint": "ea508bada721ded7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 2069}}}]}, {"ruleId": "scanner-9b48be365a19d040", "level": "error", "message": {"text": "FastAPI POST `upsert_policy` without auth dependency \u2014 src/agentic_os/api.py:2098"}, "properties": {"repobilityId": "add855a378a56f91", "scanner": "scanner-primary", "fingerprint": "9b48be365a19d040", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 2098}}}]}, {"ruleId": "scanner-bb79eb6854493d5a", "level": "error", "message": {"text": "FastAPI POST `policy_rollback` without auth dependency \u2014 src/agentic_os/api.py:2142"}, "properties": {"repobilityId": "e78535fbafba976d", "scanner": "scanner-primary", "fingerprint": "bb79eb6854493d5a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 2142}}}]}, {"ruleId": "scanner-c54aeeb220a52aa9", "level": "error", "message": {"text": "FastAPI POST `deprecate_policy` without auth dependency \u2014 src/agentic_os/api.py:2166"}, "properties": {"repobilityId": "7ab7f46c8d126330", "scanner": "scanner-primary", "fingerprint": "c54aeeb220a52aa9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 2166}}}]}, {"ruleId": "scanner-df3d0f32ddf8c9ce", "level": "error", "message": {"text": "FastAPI POST `undeprecate_policy` without auth dependency \u2014 src/agentic_os/api.py:2193"}, "properties": {"repobilityId": "831bc14a98ea3b83", "scanner": "scanner-primary", "fingerprint": "df3d0f32ddf8c9ce", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 2193}}}]}, {"ruleId": "scanner-1413d416f383fcf9", "level": "error", "message": {"text": "FastAPI POST `catalog_surfaces_patch` without auth dependency \u2014 src/agentic_os/api.py:2326"}, "properties": {"repobilityId": "f88e9f737409cfbf", "scanner": "scanner-primary", "fingerprint": "1413d416f383fcf9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 2326}}}]}, {"ruleId": "scanner-bd7be5421806ef44", "level": "error", "message": {"text": "FastAPI POST `patches_rollback` without auth dependency \u2014 src/agentic_os/api.py:2403"}, "properties": {"repobilityId": "d784080a321ce818", "scanner": "scanner-primary", "fingerprint": "bd7be5421806ef44", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 2403}}}]}, {"ruleId": "scanner-4e4e5a808081ff9e", "level": "error", "message": {"text": "FastAPI POST `registry_upsert_agent` without auth dependency \u2014 src/agentic_os/api.py:2474"}, "properties": {"repobilityId": "b562a4ef960ede6f", "scanner": "scanner-primary", "fingerprint": "4e4e5a808081ff9e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 2474}}}]}, {"ruleId": "scanner-f28fda55f5f3e0c0", "level": "error", "message": {"text": "FastAPI POST `registry_disable_agent` without auth dependency \u2014 src/agentic_os/api.py:2492"}, "properties": {"repobilityId": "381b488d83cba0c7", "scanner": "scanner-primary", "fingerprint": "f28fda55f5f3e0c0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 2492}}}]}, {"ruleId": "scanner-47e74cae787b911b", "level": "error", "message": {"text": "FastAPI POST `config_patch_endpoint` without auth dependency \u2014 src/agentic_os/api.py:2545"}, "properties": {"repobilityId": "23d9c1a06fc7316a", "scanner": "scanner-primary", "fingerprint": "47e74cae787b911b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 2545}}}]}, {"ruleId": "scanner-98dfdcf8354db20d", "level": "error", "message": {"text": "FastAPI POST `harness_config_patch_endpoint` without auth dependency \u2014 src/agentic_os/api.py:2656"}, "properties": {"repobilityId": "1db5a0493935b8ea", "scanner": "scanner-primary", "fingerprint": "98dfdcf8354db20d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 2656}}}]}, {"ruleId": "scanner-47fa58e020bba3a6", "level": "error", "message": {"text": "FastAPI POST `fleet_probe` without auth dependency \u2014 src/agentic_os/api.py:2759"}, "properties": {"repobilityId": "278022bc6d293f83", "scanner": "scanner-primary", "fingerprint": "47fa58e020bba3a6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 2759}}}]}, {"ruleId": "scanner-917c59649bb687d6", "level": "error", "message": {"text": "FastAPI POST `setup_import` without auth dependency \u2014 src/agentic_os/api.py:3166"}, "properties": {"repobilityId": "3e2fcd5664f68216", "scanner": "scanner-primary", "fingerprint": "917c59649bb687d6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 3166}}}]}, {"ruleId": "scanner-3b3984659250286e", "level": "error", "message": {"text": "FastAPI POST `upsert_workspace` without auth dependency \u2014 src/agentic_os/api.py:3197"}, "properties": {"repobilityId": "4fd70af7782f362d", "scanner": "scanner-primary", "fingerprint": "3b3984659250286e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 3197}}}]}, {"ruleId": "scanner-b4e2204956d8fe91", "level": "error", "message": {"text": "FastAPI PUT `set_active_workspace` without auth dependency \u2014 src/agentic_os/api.py:3210"}, "properties": {"repobilityId": "b83d1f0a3e5316cf", "scanner": "scanner-primary", "fingerprint": "b4e2204956d8fe91", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 3210}}}]}, {"ruleId": "scanner-41a557e81296c925", "level": "error", "message": {"text": "FastAPI POST `create_run_template` without auth dependency \u2014 src/agentic_os/api.py:3285"}, "properties": {"repobilityId": "f0b04c24d773e3f8", "scanner": "scanner-primary", "fingerprint": "41a557e81296c925", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 3285}}}]}, {"ruleId": "scanner-6bafe07a56a6cd89", "level": "error", "message": {"text": "FastAPI PUT `update_run_template` without auth dependency \u2014 src/agentic_os/api.py:3294"}, "properties": {"repobilityId": "6cb87c482c0c872d", "scanner": "scanner-primary", "fingerprint": "6bafe07a56a6cd89", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 3294}}}]}, {"ruleId": "scanner-997b826a9b3b0096", "level": "error", "message": {"text": "FastAPI DELETE `delete_run_template` without auth dependency \u2014 src/agentic_os/api.py:3309"}, "properties": {"repobilityId": "8b07965b7db30ecd", "scanner": "scanner-primary", "fingerprint": "997b826a9b3b0096", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/api.py"}, "region": {"startLine": 3309}}}]}, {"ruleId": "scanner-5fcac2870a1bb304", "level": "error", "message": {"text": "FastAPI POST `remote_pairing_start` without auth dependency \u2014 src/agentic_os/remote_api.py:50"}, "properties": {"repobilityId": "32b1da887bc292b4", "scanner": "scanner-primary", "fingerprint": "5fcac2870a1bb304", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/remote_api.py"}, "region": {"startLine": 50}}}]}, {"ruleId": "scanner-38bdb500be165485", "level": "error", "message": {"text": "FastAPI POST `remote_pairing_complete` without auth dependency \u2014 src/agentic_os/remote_api.py:55"}, "properties": {"repobilityId": "40f4831fc2c6a761", "scanner": "scanner-primary", "fingerprint": "38bdb500be165485", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/remote_api.py"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-01e6995c222a504b", "level": "error", "message": {"text": "FastAPI DELETE `remote_revoke_device` without auth dependency \u2014 src/agentic_os/remote_api.py:80"}, "properties": {"repobilityId": "2be4462046dc8210", "scanner": "scanner-primary", "fingerprint": "01e6995c222a504b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agentic_os/remote_api.py"}, "region": {"startLine": 80}}}]}, {"ruleId": "scanner-3140e61d7cac5091", "level": "note", "message": {"text": "Unused endpoint: GET /agents"}, "properties": {"repobilityId": "0739e6e790ffee4f", "scanner": "scanner-primary", "fingerprint": "3140e61d7cac5091", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b30cbdd177c13681", "level": "note", "message": {"text": "Unused endpoint: GET /agents/{agent_id}"}, "properties": {"repobilityId": "5dde001bf52d07e7", "scanner": "scanner-primary", "fingerprint": "b30cbdd177c13681", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bb69a57a408f493f", "level": "note", "message": {"text": "Unused endpoint: GET /harnesses"}, "properties": {"repobilityId": "57f13180c6fb8d58", "scanner": "scanner-primary", "fingerprint": "bb69a57a408f493f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5f7c48f4030788e1", "level": "note", "message": {"text": "Unused endpoint: GET /harnesses/validate"}, "properties": {"repobilityId": "a67bfe9c7abdc390", "scanner": "scanner-primary", "fingerprint": "5f7c48f4030788e1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3e9fe4a179ed2a55", "level": "note", "message": {"text": "Unused endpoint: GET /harnesses/{harness_id}"}, "properties": {"repobilityId": "515fdf19a53cea05", "scanner": "scanner-primary", "fingerprint": "3e9fe4a179ed2a55", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ad31945874b2029c", "level": "note", "message": {"text": "Unused endpoint: GET /tools/discovery"}, "properties": {"repobilityId": "591570709c475529", "scanner": "scanner-primary", "fingerprint": "ad31945874b2029c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7cc2ea984201809f", "level": "note", "message": {"text": "Unused endpoint: GET /tools/inventory"}, "properties": {"repobilityId": "729d2d829f6fb4bf", "scanner": "scanner-primary", "fingerprint": "7cc2ea984201809f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-332633fde5ad391d", "level": "note", "message": {"text": "Unused endpoint: GET /tools/capabilities"}, "properties": {"repobilityId": "205d4b3bfee215ce", "scanner": "scanner-primary", "fingerprint": "332633fde5ad391d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5262e871a1d14661", "level": "note", "message": {"text": "Unused endpoint: GET /tools/mcp/matrix"}, "properties": {"repobilityId": "19152d6625593048", "scanner": "scanner-primary", "fingerprint": "5262e871a1d14661", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1429ecab8793e2c7", "level": "note", "message": {"text": "Unused endpoint: POST /tools/mcp/copy"}, "properties": {"repobilityId": "3d2cf0ca5276a5f3", "scanner": "scanner-primary", "fingerprint": "1429ecab8793e2c7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bd6a3f93d7715265", "level": "note", "message": {"text": "Unused endpoint: POST /tools/mcp/remove"}, "properties": {"repobilityId": "eda2da2a3587e925", "scanner": "scanner-primary", "fingerprint": "bd6a3f93d7715265", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1838d1f7443800dd", "level": "note", "message": {"text": "Unused endpoint: GET /agentic/inventory"}, "properties": {"repobilityId": "8c566692bc764de7", "scanner": "scanner-primary", "fingerprint": "1838d1f7443800dd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7e1d38751f4805f1", "level": "note", "message": {"text": "Unused endpoint: GET /agentic/inventory/{agent_id}"}, "properties": {"repobilityId": "d725ddfba0227990", "scanner": "scanner-primary", "fingerprint": "7e1d38751f4805f1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ff79ac09a7c292db", "level": "note", "message": {"text": "Unused endpoint: GET /harness-contracts"}, "properties": {"repobilityId": "9f47e1db43e0c3c1", "scanner": "scanner-primary", "fingerprint": "ff79ac09a7c292db", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-09e933952e16a392", "level": "note", "message": {"text": "Unused endpoint: GET /harness-contracts/{harness_id}"}, "properties": {"repobilityId": "04e91a01f2203182", "scanner": "scanner-primary", "fingerprint": "09e933952e16a392", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f5bfd1bf5febca98", "level": "note", "message": {"text": "Unused endpoint: GET /harnesses/{harness_id}/health"}, "properties": {"repobilityId": "09add58068bea204", "scanner": "scanner-primary", "fingerprint": "f5bfd1bf5febca98", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-871a43f365feafdb", "level": "note", "message": {"text": "Unused endpoint: GET /harnesses/{harness_id}/logs"}, "properties": {"repobilityId": "9bc02830f8ee2611", "scanner": "scanner-primary", "fingerprint": "871a43f365feafdb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6d9534131ed7ca41", "level": "note", "message": {"text": "Unused endpoint: GET /profiles"}, "properties": {"repobilityId": "9212eeae9111268a", "scanner": "scanner-primary", "fingerprint": "6d9534131ed7ca41", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fca12bb7973e4455", "level": "note", "message": {"text": "Unused endpoint: GET /profiles/{name}"}, "properties": {"repobilityId": "79369c5d74a6d85d", "scanner": "scanner-primary", "fingerprint": "fca12bb7973e4455", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-40e097e28351ead4", "level": "note", "message": {"text": "Unused endpoint: POST /profiles"}, "properties": {"repobilityId": "f2362412f7a1215e", "scanner": "scanner-primary", "fingerprint": "40e097e28351ead4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-defef74db2536e83", "level": "note", "message": {"text": "Unused endpoint: DELETE /profiles/{name}"}, "properties": {"repobilityId": "2511f3468ea94c37", "scanner": "scanner-primary", "fingerprint": "defef74db2536e83", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f1e9e302b997df28", "level": "note", "message": {"text": "Unused endpoint: GET /profiles/{name}/diff"}, "properties": {"repobilityId": "c726485b91259096", "scanner": "scanner-primary", "fingerprint": "f1e9e302b997df28", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f041bb78464fde32", "level": "note", "message": {"text": "Unused endpoint: POST /projects/{project_path:path}/bind-profile"}, "properties": {"repobilityId": "77893395d7f5f4ea", "scanner": "scanner-primary", "fingerprint": "f041bb78464fde32", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-58e1ae5124a8deac", "level": "note", "message": {"text": "Unused endpoint: GET /usage/sessions/{session_id}"}, "properties": {"repobilityId": "48dbc65e216cb282", "scanner": "scanner-primary", "fingerprint": "58e1ae5124a8deac", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7b00dac7e0df6020", "level": "note", "message": {"text": "Unused endpoint: GET /usage/summary"}, "properties": {"repobilityId": "7ea79e1d597e0921", "scanner": "scanner-primary", "fingerprint": "7b00dac7e0df6020", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1e408081e66c2c1a", "level": "note", "message": {"text": "Unused endpoint: GET /usage/quotas"}, "properties": {"repobilityId": "6072c5b5d6412d6e", "scanner": "scanner-primary", "fingerprint": "1e408081e66c2c1a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-86bb0788a0171ec1", "level": "note", "message": {"text": "Unused endpoint: GET /harnesses/{harness_id}/activity"}, "properties": {"repobilityId": "973b952483f803f1", "scanner": "scanner-primary", "fingerprint": "86bb0788a0171ec1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-92efb2dc9205e7a4", "level": "note", "message": {"text": "Unused endpoint: POST /sessions"}, "properties": {"repobilityId": "cc5a1fa8a31270ce", "scanner": "scanner-primary", "fingerprint": "92efb2dc9205e7a4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b15d518d538de57d", "level": "note", "message": {"text": "Unused endpoint: GET /sessions"}, "properties": {"repobilityId": "15687719af034fef", "scanner": "scanner-primary", "fingerprint": "b15d518d538de57d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f888b34adc3b3ce5", "level": "note", "message": {"text": "Unused endpoint: GET /sessions/live"}, "properties": {"repobilityId": "0722a067179e987a", "scanner": "scanner-primary", "fingerprint": "f888b34adc3b3ce5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-45bd216e24f0b25c", "level": "note", "message": {"text": "Unused endpoint: GET /sessions/live/transcript"}, "properties": {"repobilityId": "63e55b5498ed0a3f", "scanner": "scanner-primary", "fingerprint": "45bd216e24f0b25c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-869c0c3d4664fe18", "level": "note", "message": {"text": "Unused endpoint: POST /sessions/live/open-terminal"}, "properties": {"repobilityId": "83dc87f4e71dc68c", "scanner": "scanner-primary", "fingerprint": "869c0c3d4664fe18", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-41c23ec3b2c0e166", "level": "note", "message": {"text": "Unused endpoint: GET /sessions/{session_id}"}, "properties": {"repobilityId": "edbd5faee07de2ba", "scanner": "scanner-primary", "fingerprint": "41c23ec3b2c0e166", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-61b18eea0e4429ad", "level": "note", "message": {"text": "Unused endpoint: GET /sessions/{session_id}/events"}, "properties": {"repobilityId": "1f4641ec399bd0d1", "scanner": "scanner-primary", "fingerprint": "61b18eea0e4429ad", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0f21fadaca1b7c37", "level": "note", "message": {"text": "Unused endpoint: GET /sessions/{session_id}/evidence"}, "properties": {"repobilityId": "ea2e14dd227a5808", "scanner": "scanner-primary", "fingerprint": "0f21fadaca1b7c37", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-caaab95d934bd808", "level": "note", "message": {"text": "Unused endpoint: GET /sessions/{session_id}/evidence.zip"}, "properties": {"repobilityId": "40ff33668aaf95cb", "scanner": "scanner-primary", "fingerprint": "caaab95d934bd808", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-182953fc9b17126e", "level": "note", "message": {"text": "Unused endpoint: GET /sessions/{session_id}/evidence/events"}, "properties": {"repobilityId": "cd4fa51a75a3ee53", "scanner": "scanner-primary", "fingerprint": "182953fc9b17126e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1e65e7bc1cd95cc9", "level": "note", "message": {"text": "Unused endpoint: GET /sessions/{session_id}/timeline"}, "properties": {"repobilityId": "e1bb2ae5536fd394", "scanner": "scanner-primary", "fingerprint": "1e65e7bc1cd95cc9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a2f636dccf9bb44e", "level": "note", "message": {"text": "Unused endpoint: GET /sessions/{session_id}/logs"}, "properties": {"repobilityId": "05fed5ef25230a1d", "scanner": "scanner-primary", "fingerprint": "a2f636dccf9bb44e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-be77127b2cba4584", "level": "note", "message": {"text": "Unused endpoint: POST /sessions/discover"}, "properties": {"repobilityId": "dd9f60ede6bee125", "scanner": "scanner-primary", "fingerprint": "be77127b2cba4584", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4d291b4883296b4a", "level": "note", "message": {"text": "Unused endpoint: POST /sessions/bind"}, "properties": {"repobilityId": "afae9d7df64dfc5b", "scanner": "scanner-primary", "fingerprint": "4d291b4883296b4a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3ec1a2c4745eabaa", "level": "note", "message": {"text": "Unused endpoint: POST /sessions/{session_id}/stop"}, "properties": {"repobilityId": "95ca90c09674ae2b", "scanner": "scanner-primary", "fingerprint": "3ec1a2c4745eabaa", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-27acb544e56dfc63", "level": "note", "message": {"text": "Unused endpoint: POST /sessions/{session_id}/retry"}, "properties": {"repobilityId": "5175bda246bc158d", "scanner": "scanner-primary", "fingerprint": "27acb544e56dfc63", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f4919c72ac3638ba", "level": "note", "message": {"text": "Unused endpoint: POST /sessions/{session_id}/attach"}, "properties": {"repobilityId": "22101356d8d6a07e", "scanner": "scanner-primary", "fingerprint": "f4919c72ac3638ba", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0518558dda792269", "level": "note", "message": {"text": "Unused endpoint: GET /approvals"}, "properties": {"repobilityId": "dce4c741bb7104e6", "scanner": "scanner-primary", "fingerprint": "0518558dda792269", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0a39229a0ad70788", "level": "note", "message": {"text": "Unused endpoint: GET /approvals/{approval_id}"}, "properties": {"repobilityId": "ecc2ef2682de8824", "scanner": "scanner-primary", "fingerprint": "0a39229a0ad70788", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f49badd3acf667c7", "level": "note", "message": {"text": "Unused endpoint: POST /approvals/{approval_id}/approve"}, "properties": {"repobilityId": "047f646b786e151d", "scanner": "scanner-primary", "fingerprint": "f49badd3acf667c7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-786daf29276dda73", "level": "note", "message": {"text": "Unused endpoint: POST /approvals/{approval_id}/reject"}, "properties": {"repobilityId": "b27d42025e93a5c3", "scanner": "scanner-primary", "fingerprint": "786daf29276dda73", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-173ee7fc8170db55", "level": "note", "message": {"text": "Unused endpoint: POST /sessions/{session_id}/memory/summary"}, "properties": {"repobilityId": "36a1cdc05c509517", "scanner": "scanner-primary", "fingerprint": "173ee7fc8170db55", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bdbc1503ae53d98b", "level": "note", "message": {"text": "Unused endpoint: GET /sessions/{session_id}/memory/summary"}, "properties": {"repobilityId": "54773350170f09ab", "scanner": "scanner-primary", "fingerprint": "bdbc1503ae53d98b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}