{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-4a409481f0713ed7", "name": "Possibly dead Python function: missing_trace_ids", "shortDescription": {"text": "Possibly dead Python function: missing_trace_ids"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-58b1a3ec26a0fc29", "name": "Possibly dead Python function: write_install_guides", "shortDescription": {"text": "Possibly dead Python function: write_install_guides"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b85588e2027045aa", "name": "Possibly dead Python function: evaluate", "shortDescription": {"text": "Possibly dead Python function: evaluate"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-23e47d76ae76beff", "name": "Possibly dead Python function: task", "shortDescription": {"text": "Possibly dead Python function: task"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0ab70e3ed7546aa7", "name": "`truncate` class without `title=` for hover reveal \u2014 skill-forge/src/components/PageHeader.tsx:17", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 skill-forge/src/components/PageHeader.tsx:17"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-779469c72b024b9b", "name": "`truncate` class without `title=` for hover reveal \u2014 skill-forge/src/components/ModelConnectionStatus.tsx:48", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 skill-forge/src/components/ModelConnectionStatus.tsx:48"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-83b0fb27fb866f0b", "name": "Icon-only button without accessible name \u2014 skill-forge/src/components/steps/KnowledgeStep.tsx:23", "shortDescription": {"text": "Icon-only button without accessible name \u2014 skill-forge/src/components/steps/KnowledgeStep.tsx:23"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d6067ce4a9495bee", "name": "`truncate` class without `title=` for hover reveal \u2014 skill-forge/src/components/steps/SupplementStep.tsx:128", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 skill-forge/src/components/steps/SupplementStep.tsx:128"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-24ce7d5617678fc2", "name": "`truncate` class without `title=` for hover reveal \u2014 skill-forge/src/pages/CreatePage.tsx:349", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 skill-forge/src/pages/CreatePage.tsx:349"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bf07bfccd055c2ca", "name": "Insecure pattern 'direct_innerhtml_assignment' in ui-accent-explorer.html:166", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in ui-accent-explorer.html:166"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7b40074c6efede71", "name": "Very large file: backend/app/orchestrator.py (1688 lines)", "shortDescription": {"text": "Very large file: backend/app/orchestrator.py (1688 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 30 placeholder/mock markers across 10 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, ci. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2c5f98b152cddb6d", "name": "Agent authority lacks a verifier contract: .claude/launch.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/launch.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-32bae54cf9afee7b", "name": "Legacy-named symbol `draft_legacy` in backend/tests/test_api_pipeline.py:473", "shortDescription": {"text": "Legacy-named symbol `draft_legacy` in backend/tests/test_api_pipeline.py:473"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-58dca01306efe11e", "name": "Legacy-named symbol `model_copy` in backend/tests/test_pydantic_agents.py:232", "shortDescription": {"text": "Legacy-named symbol `model_copy` in backend/tests/test_pydantic_agents.py:232"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2ff17d23643d608a", "name": "Legacy-named symbol `model_copy` in backend/tests/test_quality_orchestrator.py:283", "shortDescription": {"text": "Legacy-named symbol `model_copy` in backend/tests/test_quality_orchestrator.py:283"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e29ccf29f5154a35", "name": "Legacy-named symbol `draft_legacy` in backend/tests/test_quality_api.py:81", "shortDescription": {"text": "Legacy-named symbol `draft_legacy` in backend/tests/test_quality_api.py:81"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a1b8a1c3a3a91cbe", "name": "Legacy-named symbol `model_copy` in backend/app/staged_generation.py:120", "shortDescription": {"text": "Legacy-named symbol `model_copy` in backend/app/staged_generation.py:120"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b84f8990c17bf00c", "name": "Legacy-named symbol `model_copy` in backend/app/storage.py:530", "shortDescription": {"text": "Legacy-named symbol `model_copy` in backend/app/storage.py:530"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5d7ca25360d1dc48", "name": "Legacy-named symbol `model_copy` in backend/app/orchestrator.py:1623", "shortDescription": {"text": "Legacy-named symbol `model_copy` in backend/app/orchestrator.py:1623"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e2a6a13d547579b4", "name": "Legacy-named symbol `model_copy` in backend/app/agent.py:343", "shortDescription": {"text": "Legacy-named symbol `model_copy` in backend/app/agent.py:343"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fb5ad2f32b75e9b8", "name": "Legacy-named symbol `model_copy` in backend/app/spec_builder.py:260", "shortDescription": {"text": "Legacy-named symbol `model_copy` in backend/app/spec_builder.py:260"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f2b94636aeb724b6", "name": "Legacy-named symbol `_forget_secret_if_unused` in backend/app/service.py:666", "shortDescription": {"text": "Legacy-named symbol `_forget_secret_if_unused` in backend/app/service.py:666"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbackend/app/storage.py:list_generations_for_draft, backend/app/storage.py:list_generations\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49c98f7cedd9c977", "name": "Near-duplicate function bodies in 4 places", "shortDescription": {"text": "Near-duplicate function bodies in 4 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbackend/app/agent.py:generate_workflow, backend/app/agent.py:generate, backend/app/agent.py:generate_workflow, backend/app/agent.py:generate\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbackend/app/main.py:generate, backend/app/main.py:create_generation, backend/app/main.py:regenerate\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-baec88b372e069d5", "name": "FastAPI POST `create_draft` without auth dependency \u2014 backend/app/main.py:101", "shortDescription": {"text": "FastAPI POST `create_draft` without auth dependency \u2014 backend/app/main.py:101"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0f63fe52f6d17801", "name": "FastAPI PATCH `patch_draft` without auth dependency \u2014 backend/app/main.py:116", "shortDescription": {"text": "FastAPI PATCH `patch_draft` without auth dependency \u2014 backend/app/main.py:116"}, "fullDescription": {"text": "`@router.patch` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f4f0819231a7cc76", "name": "FastAPI DELETE `delete_draft` without auth dependency \u2014 backend/app/main.py:126", "shortDescription": {"text": "FastAPI DELETE `delete_draft` without auth dependency \u2014 backend/app/main.py:126"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-59e36f0785265120", "name": "FastAPI POST `generate` without auth dependency \u2014 backend/app/main.py:135", "shortDescription": {"text": "FastAPI POST `generate` without auth dependency \u2014 backend/app/main.py:135"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c1f94f1e28cf7ee9", "name": "FastAPI POST `create_generation` without auth dependency \u2014 backend/app/main.py:147", "shortDescription": {"text": "FastAPI POST `create_generation` without auth dependency \u2014 backend/app/main.py:147"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-934057ec33edaad8", "name": "FastAPI POST `cancel_generation` without auth dependency \u2014 backend/app/main.py:170", "shortDescription": {"text": "FastAPI POST `cancel_generation` without auth dependency \u2014 backend/app/main.py:170"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-237189acf9c27038", "name": "FastAPI POST `submit_supplement` without auth dependency \u2014 backend/app/main.py:213", "shortDescription": {"text": "FastAPI POST `submit_supplement` without auth dependency \u2014 backend/app/main.py:213"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-580a4a5985347d8d", "name": "FastAPI POST `install` without auth dependency \u2014 backend/app/main.py:258", "shortDescription": {"text": "FastAPI POST `install` without auth dependency \u2014 backend/app/main.py:258"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2e9afbf769f39504", "name": "FastAPI POST `regenerate` without auth dependency \u2014 backend/app/main.py:280", "shortDescription": {"text": "FastAPI POST `regenerate` without auth dependency \u2014 backend/app/main.py:280"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-272a1d5e3b73791c", "name": "FastAPI POST `create_model_provider` without auth dependency \u2014 backend/app/main.py:307", "shortDescription": {"text": "FastAPI POST `create_model_provider` without auth dependency \u2014 backend/app/main.py:307"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-aece0b833725cba7", "name": "FastAPI PATCH `patch_model_provider` without auth dependency \u2014 backend/app/main.py:318", "shortDescription": {"text": "FastAPI PATCH `patch_model_provider` without auth dependency \u2014 backend/app/main.py:318"}, "fullDescription": {"text": "`@router.patch` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-22a6059992398c66", "name": "FastAPI DELETE `delete_model_provider` without auth dependency \u2014 backend/app/main.py:325", "shortDescription": {"text": "FastAPI DELETE `delete_model_provider` without auth dependency \u2014 backend/app/main.py:325"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8b585d4b848553f7", "name": "FastAPI POST `test_model_provider` without auth dependency \u2014 backend/app/main.py:331", "shortDescription": {"text": "FastAPI POST `test_model_provider` without auth dependency \u2014 backend/app/main.py:331"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7baa32d630d81e43", "name": "FastAPI PUT `save_settings` without auth dependency \u2014 backend/app/main.py:346", "shortDescription": {"text": "FastAPI PUT `save_settings` without auth dependency \u2014 backend/app/main.py:346"}, "fullDescription": {"text": "`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4756b4c4da7d2088", "name": "Unused endpoint: GET /api/health", "shortDescription": {"text": "Unused endpoint: GET /api/health"}, "fullDescription": {"text": "`backend/app/main.py` declares `GET /api/health` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-43c79d621148648d", "name": "Unused endpoint: GET /api/runtime", "shortDescription": {"text": "Unused endpoint: GET /api/runtime"}, "fullDescription": {"text": "`backend/app/main.py` declares `GET /api/runtime` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8e76c2978204e856", "name": "Unused endpoint: GET /api/providers/connection-status", "shortDescription": {"text": "Unused endpoint: GET /api/providers/connection-status"}, "fullDescription": {"text": "`backend/app/main.py` declares `GET /api/providers/connection-status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2fc4b0a00b37aba5", "name": "Unused endpoint: POST /api/drafts", "shortDescription": {"text": "Unused endpoint: POST /api/drafts"}, "fullDescription": {"text": "`backend/app/main.py` declares `POST /api/drafts` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5e968eeaf3ebc286", "name": "Unused endpoint: GET /api/drafts", "shortDescription": {"text": "Unused endpoint: GET /api/drafts"}, "fullDescription": {"text": "`backend/app/main.py` declares `GET /api/drafts` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4e47b3b53d99b9fc", "name": "Unused endpoint: GET /api/drafts/{draft_id}", "shortDescription": {"text": "Unused endpoint: GET /api/drafts/{draft_id}"}, "fullDescription": {"text": "`backend/app/main.py` declares `GET /api/drafts/{draft_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-54421314973571ea", "name": "Unused endpoint: PATCH /api/drafts/{draft_id}", "shortDescription": {"text": "Unused endpoint: PATCH /api/drafts/{draft_id}"}, "fullDescription": {"text": "`backend/app/main.py` declares `PATCH /api/drafts/{draft_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4e2345e72616e49a", "name": "Unused endpoint: DELETE /api/drafts/{draft_id}", "shortDescription": {"text": "Unused endpoint: DELETE /api/drafts/{draft_id}"}, "fullDescription": {"text": "`backend/app/main.py` declares `DELETE /api/drafts/{draft_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b8dc3545e82d2699", "name": "Unused endpoint: POST /api/drafts/{draft_id}/generate", "shortDescription": {"text": "Unused endpoint: POST /api/drafts/{draft_id}/generate"}, "fullDescription": {"text": "`backend/app/main.py` declares `POST /api/drafts/{draft_id}/generate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4051f08d1bbd7f6a", "name": "Unused endpoint: POST /api/generations", "shortDescription": {"text": "Unused endpoint: POST /api/generations"}, "fullDescription": {"text": "`backend/app/main.py` declares `POST /api/generations` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a3dba3c60fe65639", "name": "Unused endpoint: GET /api/generations/{generation_id}", "shortDescription": {"text": "Unused endpoint: GET /api/generations/{generation_id}"}, "fullDescription": {"text": "`backend/app/main.py` declares `GET /api/generations/{generation_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-70eb8722954bd72c", "name": "Unused endpoint: POST /api/generations/{generation_id}/cancel", "shortDescription": {"text": "Unused endpoint: POST /api/generations/{generation_id}/cancel"}, "fullDescription": {"text": "`backend/app/main.py` declares `POST /api/generations/{generation_id}/cancel` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d01bfdf24b59b469", "name": "Unused endpoint: GET /api/generations/{generation_id}/quality", "shortDescription": {"text": "Unused endpoint: GET /api/generations/{generation_id}/quality"}, "fullDescription": {"text": "`backend/app/main.py` declares `GET /api/generations/{generation_id}/quality` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-79b5375e2d6fbdb7", "name": "Unused endpoint: GET /api/generations/{generation_id}/spec", "shortDescription": {"text": "Unused endpoint: GET /api/generations/{generation_id}/spec"}, "fullDescription": {"text": "`backend/app/main.py` declares `GET /api/generations/{generation_id}/spec` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7039972e74f50c75", "name": "Unused endpoint: GET /api/generations/{generation_id}/attempts", "shortDescription": {"text": "Unused endpoint: GET /api/generations/{generation_id}/attempts"}, "fullDescription": {"text": "`backend/app/main.py` declares `GET /api/generations/{generation_id}/attempts` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-22d76899fed92562", "name": "Unused endpoint: GET /api/generations/{generation_id}/trace", "shortDescription": {"text": "Unused endpoint: GET /api/generations/{generation_id}/trace"}, "fullDescription": {"text": "`backend/app/main.py` declares `GET /api/generations/{generation_id}/trace` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d1b114cefc24f762", "name": "Unused endpoint: GET /api/diagnostics/error-patterns", "shortDescription": {"text": "Unused endpoint: GET /api/diagnostics/error-patterns"}, "fullDescription": {"text": "`backend/app/main.py` declares `GET /api/diagnostics/error-patterns` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f384ff1bef748df8", "name": "Unused endpoint: GET /api/diagnostics/metrics", "shortDescription": {"text": "Unused endpoint: GET /api/diagnostics/metrics"}, "fullDescription": {"text": "`backend/app/main.py` declares `GET /api/diagnostics/metrics` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b6b86441f78f8961", "name": "Unused endpoint: POST /api/generations/{generation_id}/supplement", "shortDescription": {"text": "Unused endpoint: POST /api/generations/{generation_id}/supplement"}, "fullDescription": {"text": "`backend/app/main.py` declares `POST /api/generations/{generation_id}/supplement` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-897e8ff170f5f704", "name": "Unused endpoint: GET /api/generations/{generation_id}/preview", "shortDescription": {"text": "Unused endpoint: GET /api/generations/{generation_id}/preview"}, "fullDescription": {"text": "`backend/app/main.py` declares `GET /api/generations/{generation_id}/preview` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bbe1e7588e9906d7", "name": "Unused endpoint: GET /api/generations/{generation_id}/validation", "shortDescription": {"text": "Unused endpoint: GET /api/generations/{generation_id}/validation"}, "fullDescription": {"text": "`backend/app/main.py` declares `GET /api/generations/{generation_id}/validation` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2688314f945573aa", "name": "Unused endpoint: GET /api/generations/{generation_id}/download", "shortDescription": {"text": "Unused endpoint: GET /api/generations/{generation_id}/download"}, "fullDescription": {"text": "`backend/app/main.py` declares `GET /api/generations/{generation_id}/download` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-69cfc5a6f06e2b8f", "name": "Unused endpoint: POST /api/generations/{generation_id}/install", "shortDescription": {"text": "Unused endpoint: POST /api/generations/{generation_id}/install"}, "fullDescription": {"text": "`backend/app/main.py` declares `POST /api/generations/{generation_id}/install` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4099a1a84486e5e1", "name": "Unused endpoint: POST /api/generations/{generation_id}/regenerate", "shortDescription": {"text": "Unused endpoint: POST /api/generations/{generation_id}/regenerate"}, "fullDescription": {"text": "`backend/app/main.py` declares `POST /api/generations/{generation_id}/regenerate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0838a39160b2009d", "name": "Unused endpoint: GET /api/history", "shortDescription": {"text": "Unused endpoint: GET /api/history"}, "fullDescription": {"text": "`backend/app/main.py` declares `GET /api/history` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2a952f84dd44162f", "name": "Unused endpoint: GET /api/rules", "shortDescription": {"text": "Unused endpoint: GET /api/rules"}, "fullDescription": {"text": "`backend/app/main.py` declares `GET /api/rules` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eae1cc649081de1b", "name": "Unused endpoint: GET /api/model-providers", "shortDescription": {"text": "Unused endpoint: GET /api/model-providers"}, "fullDescription": {"text": "`backend/app/main.py` declares `GET /api/model-providers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cb1708985548a351", "name": "Unused endpoint: POST /api/model-providers", "shortDescription": {"text": "Unused endpoint: POST /api/model-providers"}, "fullDescription": {"text": "`backend/app/main.py` declares `POST /api/model-providers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3f39499728d11739", "name": "Unused endpoint: GET /api/model-providers/{provider_id}", "shortDescription": {"text": "Unused endpoint: GET /api/model-providers/{provider_id}"}, "fullDescription": {"text": "`backend/app/main.py` declares `GET /api/model-providers/{provider_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b47f02c389d43c5b", "name": "Unused endpoint: PATCH /api/model-providers/{provider_id}", "shortDescription": {"text": "Unused endpoint: PATCH /api/model-providers/{provider_id}"}, "fullDescription": {"text": "`backend/app/main.py` declares `PATCH /api/model-providers/{provider_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ffd9d3a49df949f5", "name": "Unused endpoint: DELETE /api/model-providers/{provider_id}", "shortDescription": {"text": "Unused endpoint: DELETE /api/model-providers/{provider_id}"}, "fullDescription": {"text": "`backend/app/main.py` declares `DELETE /api/model-providers/{provider_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-24666485f87b6973", "name": "Unused endpoint: POST /api/model-providers/{provider_id}/test", "shortDescription": {"text": "Unused endpoint: POST /api/model-providers/{provider_id}/test"}, "fullDescription": {"text": "`backend/app/main.py` declares `POST /api/model-providers/{provider_id}/test` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-86b0796abe2974fc", "name": "Unused endpoint: GET /api/cli/commands", "shortDescription": {"text": "Unused endpoint: GET /api/cli/commands"}, "fullDescription": {"text": "`backend/app/main.py` declares `GET /api/cli/commands` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-379b09f9de636500", "name": "Unused endpoint: GET /api/settings", "shortDescription": {"text": "Unused endpoint: GET /api/settings"}, "fullDescription": {"text": "`backend/app/main.py` declares `GET /api/settings` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2bffc2596a61e55e", "name": "Unused endpoint: PUT /api/settings", "shortDescription": {"text": "Unused endpoint: PUT /api/settings"}, "fullDescription": {"text": "`backend/app/main.py` declares `PUT /api/settings` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/22103"}, "properties": {"repository": "vc999999999/novafde", "repoUrl": "https://github.com/vc999999999/novafde", "branch": "main"}, "results": [{"ruleId": "scanner-4a409481f0713ed7", "level": "note", "message": {"text": "Possibly dead Python function: missing_trace_ids"}, "properties": {"repobilityId": "b9c4f5f176826fce", "scanner": "scanner-primary", "fingerprint": "4a409481f0713ed7", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/staged_generation.py:243"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-58b1a3ec26a0fc29", "level": "note", "message": {"text": "Possibly dead Python function: write_install_guides"}, "properties": {"repobilityId": "ce67e74ba414d68b", "scanner": "scanner-primary", "fingerprint": "58b1a3ec26a0fc29", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/adapter.py:22"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b85588e2027045aa", "level": "note", "message": {"text": "Possibly dead Python function: evaluate"}, "properties": {"repobilityId": "5b46064c9efd29c3", "scanner": "scanner-primary", "fingerprint": "b85588e2027045aa", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/evals/run_model_evals.py:17"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-23e47d76ae76beff", "level": "note", "message": {"text": "Possibly dead Python function: task"}, "properties": {"repobilityId": "201fcc917f27bd31", "scanner": "scanner-primary", "fingerprint": "23e47d76ae76beff", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/evals/run_model_evals.py:96"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0ab70e3ed7546aa7", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 skill-forge/src/components/PageHeader.tsx:17"}, "properties": {"repobilityId": "42b42b7ba286bfc9", "scanner": "scanner-primary", "fingerprint": "0ab70e3ed7546aa7", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-779469c72b024b9b", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 skill-forge/src/components/ModelConnectionStatus.tsx:48"}, "properties": {"repobilityId": "8b72260245d69019", "scanner": "scanner-primary", "fingerprint": "779469c72b024b9b", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-83b0fb27fb866f0b", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 skill-forge/src/components/steps/KnowledgeStep.tsx:23"}, "properties": {"repobilityId": "cee639ec8b744cfb", "scanner": "scanner-primary", "fingerprint": "83b0fb27fb866f0b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-d6067ce4a9495bee", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 skill-forge/src/components/steps/SupplementStep.tsx:128"}, "properties": {"repobilityId": "a98e7bcce07f79c1", "scanner": "scanner-primary", "fingerprint": "d6067ce4a9495bee", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-24ce7d5617678fc2", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 skill-forge/src/pages/CreatePage.tsx:349"}, "properties": {"repobilityId": "2d339420853644e0", "scanner": "scanner-primary", "fingerprint": "24ce7d5617678fc2", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-bf07bfccd055c2ca", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in ui-accent-explorer.html:166"}, "properties": {"repobilityId": "101e19127250d0d0", "scanner": "scanner-primary", "fingerprint": "bf07bfccd055c2ca", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui-accent-explorer.html"}, "region": {"startLine": 166}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-7b40074c6efede71", "level": "note", "message": {"text": "Very large file: backend/app/orchestrator.py (1688 lines)"}, "properties": {"repobilityId": "3122a0218d5aa13a", "scanner": "scanner-primary", "fingerprint": "7b40074c6efede71", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "67b5bc86f01544cd", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "7dc77f2f87944446", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "ff13790c09fadc86", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "bfeecc5e8ff59ce4", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "c2b164b2c20fe6cf", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "4810d17097ab5280", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "2c46347be2c2a460", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-2c5f98b152cddb6d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/launch.json"}, "properties": {"repobilityId": "0de48c0f4ab303d8", "scanner": "scanner-primary", "fingerprint": "2c5f98b152cddb6d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/launch.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-32bae54cf9afee7b", "level": "note", "message": {"text": "Legacy-named symbol `draft_legacy` in backend/tests/test_api_pipeline.py:473"}, "properties": {"repobilityId": "db185c7503b2d0a3", "scanner": "scanner-primary", "fingerprint": "32bae54cf9afee7b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-58dca01306efe11e", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in backend/tests/test_pydantic_agents.py:232"}, "properties": {"repobilityId": "2c746d375a5f3222", "scanner": "scanner-primary", "fingerprint": "58dca01306efe11e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-2ff17d23643d608a", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in backend/tests/test_quality_orchestrator.py:283"}, "properties": {"repobilityId": "bceb3a84512fd1a7", "scanner": "scanner-primary", "fingerprint": "2ff17d23643d608a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-e29ccf29f5154a35", "level": "note", "message": {"text": "Legacy-named symbol `draft_legacy` in backend/tests/test_quality_api.py:81"}, "properties": {"repobilityId": "a904a1b6decfab68", "scanner": "scanner-primary", "fingerprint": "e29ccf29f5154a35", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-a1b8a1c3a3a91cbe", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in backend/app/staged_generation.py:120"}, "properties": {"repobilityId": "9eddd8425ec46fc4", "scanner": "scanner-primary", "fingerprint": "a1b8a1c3a3a91cbe", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-b84f8990c17bf00c", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in backend/app/storage.py:530"}, "properties": {"repobilityId": "7158d263e1440c91", "scanner": "scanner-primary", "fingerprint": "b84f8990c17bf00c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-5d7ca25360d1dc48", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in backend/app/orchestrator.py:1623"}, "properties": {"repobilityId": "5effa73915e9b59c", "scanner": "scanner-primary", "fingerprint": "5d7ca25360d1dc48", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-e2a6a13d547579b4", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in backend/app/agent.py:343"}, "properties": {"repobilityId": "4ab912254150abb6", "scanner": "scanner-primary", "fingerprint": "e2a6a13d547579b4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-fb5ad2f32b75e9b8", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in backend/app/spec_builder.py:260"}, "properties": {"repobilityId": "4fa73efed89f49d3", "scanner": "scanner-primary", "fingerprint": "fb5ad2f32b75e9b8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-f2b94636aeb724b6", "level": "note", "message": {"text": "Legacy-named symbol `_forget_secret_if_unused` in backend/app/service.py:666"}, "properties": {"repobilityId": "d15ecc06323efbe7", "scanner": "scanner-primary", "fingerprint": "f2b94636aeb724b6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "156f9170894dd38b", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "9536649c0cf64657", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "0f72c0ba8b83d91c", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "7f2615ef0cdc5eec", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "fc3b75f455d13c91", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "be4644066586e321", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "6ebaab84327fd79c", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "51d887b2f0d4c83b", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "486a639420d9160d", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "acd3e37347b27bfe", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "76e4f20f23290543", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-baec88b372e069d5", "level": "error", "message": {"text": "FastAPI POST `create_draft` without auth dependency \u2014 backend/app/main.py:101"}, "properties": {"repobilityId": "c7557377a3db256c", "scanner": "scanner-primary", "fingerprint": "baec88b372e069d5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/main.py"}, "region": {"startLine": 101}}}]}, {"ruleId": "scanner-0f63fe52f6d17801", "level": "error", "message": {"text": "FastAPI PATCH `patch_draft` without auth dependency \u2014 backend/app/main.py:116"}, "properties": {"repobilityId": "5d83c4edccf3c445", "scanner": "scanner-primary", "fingerprint": "0f63fe52f6d17801", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/main.py"}, "region": {"startLine": 116}}}]}, {"ruleId": "scanner-f4f0819231a7cc76", "level": "error", "message": {"text": "FastAPI DELETE `delete_draft` without auth dependency \u2014 backend/app/main.py:126"}, "properties": {"repobilityId": "f4c0e19a820a2e46", "scanner": "scanner-primary", "fingerprint": "f4f0819231a7cc76", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/main.py"}, "region": {"startLine": 126}}}]}, {"ruleId": "scanner-59e36f0785265120", "level": "error", "message": {"text": "FastAPI POST `generate` without auth dependency \u2014 backend/app/main.py:135"}, "properties": {"repobilityId": "1ac053cb928b1af8", "scanner": "scanner-primary", "fingerprint": "59e36f0785265120", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/main.py"}, "region": {"startLine": 135}}}]}, {"ruleId": "scanner-c1f94f1e28cf7ee9", "level": "error", "message": {"text": "FastAPI POST `create_generation` without auth dependency \u2014 backend/app/main.py:147"}, "properties": {"repobilityId": "13bd1bce89eb31d3", "scanner": "scanner-primary", "fingerprint": "c1f94f1e28cf7ee9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/main.py"}, "region": {"startLine": 147}}}]}, {"ruleId": "scanner-934057ec33edaad8", "level": "error", "message": {"text": "FastAPI POST `cancel_generation` without auth dependency \u2014 backend/app/main.py:170"}, "properties": {"repobilityId": "29c6a75a5a5bf174", "scanner": "scanner-primary", "fingerprint": "934057ec33edaad8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/main.py"}, "region": {"startLine": 170}}}]}, {"ruleId": "scanner-237189acf9c27038", "level": "error", "message": {"text": "FastAPI POST `submit_supplement` without auth dependency \u2014 backend/app/main.py:213"}, "properties": {"repobilityId": "43274e091f3110c3", "scanner": "scanner-primary", "fingerprint": "237189acf9c27038", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/main.py"}, "region": {"startLine": 213}}}]}, {"ruleId": "scanner-580a4a5985347d8d", "level": "error", "message": {"text": "FastAPI POST `install` without auth dependency \u2014 backend/app/main.py:258"}, "properties": {"repobilityId": "54e67e5d6df0d1c0", "scanner": "scanner-primary", "fingerprint": "580a4a5985347d8d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/main.py"}, "region": {"startLine": 258}}}]}, {"ruleId": "scanner-2e9afbf769f39504", "level": "error", "message": {"text": "FastAPI POST `regenerate` without auth dependency \u2014 backend/app/main.py:280"}, "properties": {"repobilityId": "50efce08a9d07528", "scanner": "scanner-primary", "fingerprint": "2e9afbf769f39504", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/main.py"}, "region": {"startLine": 280}}}]}, {"ruleId": "scanner-272a1d5e3b73791c", "level": "error", "message": {"text": "FastAPI POST `create_model_provider` without auth dependency \u2014 backend/app/main.py:307"}, "properties": {"repobilityId": "0ac9bfc10688ea53", "scanner": "scanner-primary", "fingerprint": "272a1d5e3b73791c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/main.py"}, "region": {"startLine": 307}}}]}, {"ruleId": "scanner-aece0b833725cba7", "level": "error", "message": {"text": "FastAPI PATCH `patch_model_provider` without auth dependency \u2014 backend/app/main.py:318"}, "properties": {"repobilityId": "81bcd20c75d7e90d", "scanner": "scanner-primary", "fingerprint": "aece0b833725cba7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/main.py"}, "region": {"startLine": 318}}}]}, {"ruleId": "scanner-22a6059992398c66", "level": "error", "message": {"text": "FastAPI DELETE `delete_model_provider` without auth dependency \u2014 backend/app/main.py:325"}, "properties": {"repobilityId": "719d8acabd51f96c", "scanner": "scanner-primary", "fingerprint": "22a6059992398c66", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/main.py"}, "region": {"startLine": 325}}}]}, {"ruleId": "scanner-8b585d4b848553f7", "level": "error", "message": {"text": "FastAPI POST `test_model_provider` without auth dependency \u2014 backend/app/main.py:331"}, "properties": {"repobilityId": "96197dea0157a70b", "scanner": "scanner-primary", "fingerprint": "8b585d4b848553f7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/main.py"}, "region": {"startLine": 331}}}]}, {"ruleId": "scanner-7baa32d630d81e43", "level": "error", "message": {"text": "FastAPI PUT `save_settings` without auth dependency \u2014 backend/app/main.py:346"}, "properties": {"repobilityId": "9db76bb0057c0055", "scanner": "scanner-primary", "fingerprint": "7baa32d630d81e43", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/main.py"}, "region": {"startLine": 346}}}]}, {"ruleId": "scanner-4756b4c4da7d2088", "level": "note", "message": {"text": "Unused endpoint: GET /api/health"}, "properties": {"repobilityId": "414de3a0f9ad89dd", "scanner": "scanner-primary", "fingerprint": "4756b4c4da7d2088", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-43c79d621148648d", "level": "note", "message": {"text": "Unused endpoint: GET /api/runtime"}, "properties": {"repobilityId": "0a896ebf2647369d", "scanner": "scanner-primary", "fingerprint": "43c79d621148648d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8e76c2978204e856", "level": "note", "message": {"text": "Unused endpoint: GET /api/providers/connection-status"}, "properties": {"repobilityId": "e3b464ab01237768", "scanner": "scanner-primary", "fingerprint": "8e76c2978204e856", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2fc4b0a00b37aba5", "level": "note", "message": {"text": "Unused endpoint: POST /api/drafts"}, "properties": {"repobilityId": "2016499f1e7eac79", "scanner": "scanner-primary", "fingerprint": "2fc4b0a00b37aba5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5e968eeaf3ebc286", "level": "note", "message": {"text": "Unused endpoint: GET /api/drafts"}, "properties": {"repobilityId": "577316cbef8e97f9", "scanner": "scanner-primary", "fingerprint": "5e968eeaf3ebc286", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4e47b3b53d99b9fc", "level": "note", "message": {"text": "Unused endpoint: GET /api/drafts/{draft_id}"}, "properties": {"repobilityId": "c237a81a48a233ec", "scanner": "scanner-primary", "fingerprint": "4e47b3b53d99b9fc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-54421314973571ea", "level": "note", "message": {"text": "Unused endpoint: PATCH /api/drafts/{draft_id}"}, "properties": {"repobilityId": "ede0c6ad0bf21ee2", "scanner": "scanner-primary", "fingerprint": "54421314973571ea", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4e2345e72616e49a", "level": "note", "message": {"text": "Unused endpoint: DELETE /api/drafts/{draft_id}"}, "properties": {"repobilityId": "193751c54c268ef5", "scanner": "scanner-primary", "fingerprint": "4e2345e72616e49a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b8dc3545e82d2699", "level": "note", "message": {"text": "Unused endpoint: POST /api/drafts/{draft_id}/generate"}, "properties": {"repobilityId": "fd2a862cd500cbb9", "scanner": "scanner-primary", "fingerprint": "b8dc3545e82d2699", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4051f08d1bbd7f6a", "level": "note", "message": {"text": "Unused endpoint: POST /api/generations"}, "properties": {"repobilityId": "2bc6dfee0cd8e7f6", "scanner": "scanner-primary", "fingerprint": "4051f08d1bbd7f6a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a3dba3c60fe65639", "level": "note", "message": {"text": "Unused endpoint: GET /api/generations/{generation_id}"}, "properties": {"repobilityId": "29ef7de12851c809", "scanner": "scanner-primary", "fingerprint": "a3dba3c60fe65639", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-70eb8722954bd72c", "level": "note", "message": {"text": "Unused endpoint: POST /api/generations/{generation_id}/cancel"}, "properties": {"repobilityId": "95de07a6235f87e9", "scanner": "scanner-primary", "fingerprint": "70eb8722954bd72c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d01bfdf24b59b469", "level": "note", "message": {"text": "Unused endpoint: GET /api/generations/{generation_id}/quality"}, "properties": {"repobilityId": "defc1d61d014a8ed", "scanner": "scanner-primary", "fingerprint": "d01bfdf24b59b469", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-79b5375e2d6fbdb7", "level": "note", "message": {"text": "Unused endpoint: GET /api/generations/{generation_id}/spec"}, "properties": {"repobilityId": "24dfdeb9d7e864cd", "scanner": "scanner-primary", "fingerprint": "79b5375e2d6fbdb7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7039972e74f50c75", "level": "note", "message": {"text": "Unused endpoint: GET /api/generations/{generation_id}/attempts"}, "properties": {"repobilityId": "1d40676abfcd4ef2", "scanner": "scanner-primary", "fingerprint": "7039972e74f50c75", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-22d76899fed92562", "level": "note", "message": {"text": "Unused endpoint: GET /api/generations/{generation_id}/trace"}, "properties": {"repobilityId": "64b0ff21892b4e51", "scanner": "scanner-primary", "fingerprint": "22d76899fed92562", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d1b114cefc24f762", "level": "note", "message": {"text": "Unused endpoint: GET /api/diagnostics/error-patterns"}, "properties": {"repobilityId": "1bf3fb3cdbd137f0", "scanner": "scanner-primary", "fingerprint": "d1b114cefc24f762", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f384ff1bef748df8", "level": "note", "message": {"text": "Unused endpoint: GET /api/diagnostics/metrics"}, "properties": {"repobilityId": "075601e14fb879ca", "scanner": "scanner-primary", "fingerprint": "f384ff1bef748df8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b6b86441f78f8961", "level": "note", "message": {"text": "Unused endpoint: POST /api/generations/{generation_id}/supplement"}, "properties": {"repobilityId": "26f3050e826e365d", "scanner": "scanner-primary", "fingerprint": "b6b86441f78f8961", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-897e8ff170f5f704", "level": "note", "message": {"text": "Unused endpoint: GET /api/generations/{generation_id}/preview"}, "properties": {"repobilityId": "bb632a478a5ff619", "scanner": "scanner-primary", "fingerprint": "897e8ff170f5f704", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bbe1e7588e9906d7", "level": "note", "message": {"text": "Unused endpoint: GET /api/generations/{generation_id}/validation"}, "properties": {"repobilityId": "4473ec5d5ba0786d", "scanner": "scanner-primary", "fingerprint": "bbe1e7588e9906d7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2688314f945573aa", "level": "note", "message": {"text": "Unused endpoint: GET /api/generations/{generation_id}/download"}, "properties": {"repobilityId": "b7f1d0f0f398db76", "scanner": "scanner-primary", "fingerprint": "2688314f945573aa", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-69cfc5a6f06e2b8f", "level": "note", "message": {"text": "Unused endpoint: POST /api/generations/{generation_id}/install"}, "properties": {"repobilityId": "42d5ade61700dd2c", "scanner": "scanner-primary", "fingerprint": "69cfc5a6f06e2b8f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4099a1a84486e5e1", "level": "note", "message": {"text": "Unused endpoint: POST /api/generations/{generation_id}/regenerate"}, "properties": {"repobilityId": "f1d3cb54f0e5a910", "scanner": "scanner-primary", "fingerprint": "4099a1a84486e5e1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0838a39160b2009d", "level": "note", "message": {"text": "Unused endpoint: GET /api/history"}, "properties": {"repobilityId": "9efb54fe75a22d39", "scanner": "scanner-primary", "fingerprint": "0838a39160b2009d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2a952f84dd44162f", "level": "note", "message": {"text": "Unused endpoint: GET /api/rules"}, "properties": {"repobilityId": "4ed2e491d9d48432", "scanner": "scanner-primary", "fingerprint": "2a952f84dd44162f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-eae1cc649081de1b", "level": "note", "message": {"text": "Unused endpoint: GET /api/model-providers"}, "properties": {"repobilityId": "fbef0071a8f0ffd5", "scanner": "scanner-primary", "fingerprint": "eae1cc649081de1b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cb1708985548a351", "level": "note", "message": {"text": "Unused endpoint: POST /api/model-providers"}, "properties": {"repobilityId": "5c8b78ddfb98889c", "scanner": "scanner-primary", "fingerprint": "cb1708985548a351", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3f39499728d11739", "level": "note", "message": {"text": "Unused endpoint: GET /api/model-providers/{provider_id}"}, "properties": {"repobilityId": "0e14edbf30e37ba4", "scanner": "scanner-primary", "fingerprint": "3f39499728d11739", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b47f02c389d43c5b", "level": "note", "message": {"text": "Unused endpoint: PATCH /api/model-providers/{provider_id}"}, "properties": {"repobilityId": "e93912ca2eab7406", "scanner": "scanner-primary", "fingerprint": "b47f02c389d43c5b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ffd9d3a49df949f5", "level": "note", "message": {"text": "Unused endpoint: DELETE /api/model-providers/{provider_id}"}, "properties": {"repobilityId": "2699b2d1ee712eef", "scanner": "scanner-primary", "fingerprint": "ffd9d3a49df949f5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-24666485f87b6973", "level": "note", "message": {"text": "Unused endpoint: POST /api/model-providers/{provider_id}/test"}, "properties": {"repobilityId": "52a443b1ac64ec33", "scanner": "scanner-primary", "fingerprint": "24666485f87b6973", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-86b0796abe2974fc", "level": "note", "message": {"text": "Unused endpoint: GET /api/cli/commands"}, "properties": {"repobilityId": "55fea7b9c9cfdfe7", "scanner": "scanner-primary", "fingerprint": "86b0796abe2974fc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-379b09f9de636500", "level": "note", "message": {"text": "Unused endpoint: GET /api/settings"}, "properties": {"repobilityId": "f8ee5dfe350b4aff", "scanner": "scanner-primary", "fingerprint": "379b09f9de636500", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2bffc2596a61e55e", "level": "note", "message": {"text": "Unused endpoint: PUT /api/settings"}, "properties": {"repobilityId": "61c10ea8d270c570", "scanner": "scanner-primary", "fingerprint": "2bffc2596a61e55e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}