{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-65e3146ddb4311c8", "name": "Stray `console.log` in TS/JS \u2014 server/index.js:3387", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 server/index.js:3387"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-22a007ef059ce45f", "name": "Insecure pattern 'node_child_process' in scripts/prepare-tauri-sidecar.mjs:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/prepare-tauri-sidecar.mjs:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e99fc5c83846214c", "name": "Insecure pattern 'node_child_process' in server/index.js:4", "shortDescription": {"text": "Insecure pattern 'node_child_process' in server/index.js:4"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-904b3471d2cfe95d", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "softprops/action-gh-release@v2 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3bd1d48a144f5b02", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-391adb6592443f79", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "softprops/action-gh-release@v2 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dee297f21d82e978", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-427a4caf1eb4f830", "name": "Very large file: server/index.js (4268 lines)", "shortDescription": {"text": "Very large file: server/index.js (4268 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e64c2d422536680f", "name": "Very large file: src/main.jsx (2757 lines)", "shortDescription": {"text": "Very large file: src/main.jsx (2757 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 8 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9d79c4077342a7d0", "name": "Runtime service client appears to use placeholder configuration", "shortDescription": {"text": "Runtime service client appears to use placeholder configuration"}, "fullDescription": {"text": "A runtime source file appears to wire Supabase/Firebase/AI/payment-style clients to placeholder URLs, keys, or fallback values. In the Fable corpus this often means the UI/API shape is present while the backend service is not actually configured."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-11825279136b53a3", "name": "CI is configured but no tests are detected", "shortDescription": {"text": "CI is configured but no tests are detected"}, "fullDescription": {"text": "A CI pipeline exists, but the scan found no test files to gate. Opus labeled this generated-code pattern as config theater: release machinery exists, but it has little behavioral signal."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a4cddcaa8b169dc6", "name": "Legacy-named symbol `eleven_multilingual_v2` in server/index.js:175", "shortDescription": {"text": "Legacy-named symbol `eleven_multilingual_v2` in server/index.js:175"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f2b89dbfdb650522", "name": "`fetch()` without try/.catch or AbortSignal \u2014 server/index.js:1173", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 server/index.js:1173"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b00df46cba3baaed", "name": "Legacy-named symbol `eleven_multilingual_v2` in src/main.jsx:1501", "shortDescription": {"text": "Legacy-named symbol `eleven_multilingual_v2` in src/main.jsx:1501"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-87acb4066071a15a", "name": "19 env vars used in code but missing from .env.example", "shortDescription": {"text": "19 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `CARGO_BUILD_TARGET`, `ELEVENLABS_API_KEY`, `FFMPEG_PATH`, `GOOGLE_API_KEY`, `GROK_API_KEY`, `NODE_ENV`, `OPENAI_TRANSCRIPTION_MODEL`, `PILLAR_BACKEND_DIR` + 11 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a61eecfbaaf9ac1c", "name": "Dangling fetch: POST http://${host}:${port}/api/runtime/shutdown (server/index.js:4261)", "shortDescription": {"text": "Dangling fetch: POST http://${host}:${port}/api/runtime/shutdown (server/index.js:4261)"}, "fullDescription": {"text": "`server/index.js:4261` calls `POST http://${host}:${port}/api/runtime/shutdown` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/http:/<p>:/<p>/api/runtime/shutdown`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-27652a11ba620012", "name": "Unused endpoint: GET /api/state", "shortDescription": {"text": "Unused endpoint: GET /api/state"}, "fullDescription": {"text": "`server/index.js` declares `GET /api/state` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-81e12a447f9a88e1", "name": "Unused endpoint: GET /api/notifications/latest-brief", "shortDescription": {"text": "Unused endpoint: GET /api/notifications/latest-brief"}, "fullDescription": {"text": "`server/index.js` declares `GET /api/notifications/latest-brief` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-db942cb36aafb88d", "name": "Unused endpoint: POST /api/runtime/shutdown", "shortDescription": {"text": "Unused endpoint: POST /api/runtime/shutdown"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/runtime/shutdown` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-923125efe30ed7be", "name": "Unused endpoint: GET /api/runtime/ffmpeg", "shortDescription": {"text": "Unused endpoint: GET /api/runtime/ffmpeg"}, "fullDescription": {"text": "`server/index.js` declares `GET /api/runtime/ffmpeg` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9d3fe321a165282b", "name": "Unused endpoint: GET /api/runtime/stt", "shortDescription": {"text": "Unused endpoint: GET /api/runtime/stt"}, "fullDescription": {"text": "`server/index.js` declares `GET /api/runtime/stt` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72465f7b65470208", "name": "Unused endpoint: GET /api/audio/:fileName", "shortDescription": {"text": "Unused endpoint: GET /api/audio/:fileName"}, "fullDescription": {"text": "`server/index.js` declares `GET /api/audio/:fileName` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bcefa1a8972c695c", "name": "Unused endpoint: POST /api/runtime/stt/model/install", "shortDescription": {"text": "Unused endpoint: POST /api/runtime/stt/model/install"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/runtime/stt/model/install` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d8a44c8f128ab6db", "name": "Unused endpoint: POST /api/runtime/ffmpeg/install", "shortDescription": {"text": "Unused endpoint: POST /api/runtime/ffmpeg/install"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/runtime/ffmpeg/install` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8b24b7e392eae52f", "name": "Unused endpoint: POST /api/runtime/open-url", "shortDescription": {"text": "Unused endpoint: POST /api/runtime/open-url"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/runtime/open-url` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d948519b70d43868", "name": "Unused endpoint: GET /api/onboarding", "shortDescription": {"text": "Unused endpoint: GET /api/onboarding"}, "fullDescription": {"text": "`server/index.js` declares `GET /api/onboarding` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d900292b65fc0212", "name": "Unused endpoint: PATCH /api/onboarding", "shortDescription": {"text": "Unused endpoint: PATCH /api/onboarding"}, "fullDescription": {"text": "`server/index.js` declares `PATCH /api/onboarding` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-24ef6cb8ddddff72", "name": "Unused endpoint: POST /api/onboarding/brief-setup-draft", "shortDescription": {"text": "Unused endpoint: POST /api/onboarding/brief-setup-draft"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/onboarding/brief-setup-draft` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f60d25f7bc479a78", "name": "Unused endpoint: POST /api/onboarding/brief-setup-apply", "shortDescription": {"text": "Unused endpoint: POST /api/onboarding/brief-setup-apply"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/onboarding/brief-setup-apply` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e27176dacd4d043a", "name": "Unused endpoint: POST /api/onboarding/source-suggestions", "shortDescription": {"text": "Unused endpoint: POST /api/onboarding/source-suggestions"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/onboarding/source-suggestions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-11335877ac584df4", "name": "Unused endpoint: POST /api/onboarding/complete", "shortDescription": {"text": "Unused endpoint: POST /api/onboarding/complete"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/onboarding/complete` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ed9b9a006578a45", "name": "Unused endpoint: POST /api/onboarding/skip", "shortDescription": {"text": "Unused endpoint: POST /api/onboarding/skip"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/onboarding/skip` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49b52bcb0bcab42c", "name": "Unused endpoint: POST /api/onboarding/reset", "shortDescription": {"text": "Unused endpoint: POST /api/onboarding/reset"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/onboarding/reset` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6656b51e8fa7f4dd", "name": "Unused endpoint: PATCH /api/brief-config", "shortDescription": {"text": "Unused endpoint: PATCH /api/brief-config"}, "fullDescription": {"text": "`server/index.js` declares `PATCH /api/brief-config` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-63d276bd168250f0", "name": "Unused endpoint: POST /api/perspective-lenses/generate", "shortDescription": {"text": "Unused endpoint: POST /api/perspective-lenses/generate"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/perspective-lenses/generate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fa47b793ab470008", "name": "Unused endpoint: POST /api/workflow-runs/:id/deliberate", "shortDescription": {"text": "Unused endpoint: POST /api/workflow-runs/:id/deliberate"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/workflow-runs/:id/deliberate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2f560e03ed234dca", "name": "Unused endpoint: POST /api/sources", "shortDescription": {"text": "Unused endpoint: POST /api/sources"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/sources` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6588bdc3eea4e0f9", "name": "Unused endpoint: POST /api/podcast/resolve-spotify", "shortDescription": {"text": "Unused endpoint: POST /api/podcast/resolve-spotify"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/podcast/resolve-spotify` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3e02dc8ba6013b97", "name": "Unused endpoint: POST /api/sources/:id/transcribe", "shortDescription": {"text": "Unused endpoint: POST /api/sources/:id/transcribe"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/sources/:id/transcribe` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-60cb14b4eeef48dd", "name": "Unused endpoint: POST /api/sources/:id/fetch-x", "shortDescription": {"text": "Unused endpoint: POST /api/sources/:id/fetch-x"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/sources/:id/fetch-x` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6e5d8e1a57964131", "name": "Unused endpoint: PATCH /api/sources/:id", "shortDescription": {"text": "Unused endpoint: PATCH /api/sources/:id"}, "fullDescription": {"text": "`server/index.js` declares `PATCH /api/sources/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a6b4285b486e71e5", "name": "Unused endpoint: DELETE /api/sources/:id", "shortDescription": {"text": "Unused endpoint: DELETE /api/sources/:id"}, "fullDescription": {"text": "`server/index.js` declares `DELETE /api/sources/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1f09896279363b56", "name": "Unused endpoint: POST /api/lenses", "shortDescription": {"text": "Unused endpoint: POST /api/lenses"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/lenses` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c686cfe4b6a5eb6", "name": "Unused endpoint: PATCH /api/lenses/:id", "shortDescription": {"text": "Unused endpoint: PATCH /api/lenses/:id"}, "fullDescription": {"text": "`server/index.js` declares `PATCH /api/lenses/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b6b8916de9128dce", "name": "Unused endpoint: POST /api/councils", "shortDescription": {"text": "Unused endpoint: POST /api/councils"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/councils` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-144a0970f69df2ed", "name": "Unused endpoint: POST /api/documents", "shortDescription": {"text": "Unused endpoint: POST /api/documents"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/documents` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bfd68f5ce4a8eca4", "name": "Unused endpoint: PATCH /api/documents/:id", "shortDescription": {"text": "Unused endpoint: PATCH /api/documents/:id"}, "fullDescription": {"text": "`server/index.js` declares `PATCH /api/documents/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f025e0d8aa4b1c72", "name": "Unused endpoint: POST /api/workflow-runs", "shortDescription": {"text": "Unused endpoint: POST /api/workflow-runs"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/workflow-runs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-feb61e371f8e94a0", "name": "Unused endpoint: GET /api/workflow-runs/:id", "shortDescription": {"text": "Unused endpoint: GET /api/workflow-runs/:id"}, "fullDescription": {"text": "`server/index.js` declares `GET /api/workflow-runs/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7637c348fff99a44", "name": "Unused endpoint: POST /api/workflow-runs/:id/audio", "shortDescription": {"text": "Unused endpoint: POST /api/workflow-runs/:id/audio"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/workflow-runs/:id/audio` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b4317839fa76eb54", "name": "Unused endpoint: PATCH /api/approvals/:id", "shortDescription": {"text": "Unused endpoint: PATCH /api/approvals/:id"}, "fullDescription": {"text": "`server/index.js` declares `PATCH /api/approvals/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c2eee0486e3fb45e", "name": "Unused endpoint: PATCH /api/telegram", "shortDescription": {"text": "Unused endpoint: PATCH /api/telegram"}, "fullDescription": {"text": "`server/index.js` declares `PATCH /api/telegram` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fe3ee47768f6dd0c", "name": "Unused endpoint: POST /api/telegram/token/validate", "shortDescription": {"text": "Unused endpoint: POST /api/telegram/token/validate"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/telegram/token/validate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3614b6addc94340d", "name": "Unused endpoint: POST /api/telegram/pairing/start", "shortDescription": {"text": "Unused endpoint: POST /api/telegram/pairing/start"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/telegram/pairing/start` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bc4700f58f7d6692", "name": "Unused endpoint: GET /api/telegram/pairing/:id", "shortDescription": {"text": "Unused endpoint: GET /api/telegram/pairing/:id"}, "fullDescription": {"text": "`server/index.js` declares `GET /api/telegram/pairing/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f6750ab3ff58c019", "name": "Unused endpoint: GET /api/telegram/pairing/:id/qr.svg", "shortDescription": {"text": "Unused endpoint: GET /api/telegram/pairing/:id/qr.svg"}, "fullDescription": {"text": "`server/index.js` declares `GET /api/telegram/pairing/:id/qr.svg` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bcbcf10216b61e0d", "name": "Unused endpoint: POST /api/telegram/pairing/:id/poll", "shortDescription": {"text": "Unused endpoint: POST /api/telegram/pairing/:id/poll"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/telegram/pairing/:id/poll` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5cd15a93098bfa5f", "name": "Unused endpoint: POST /api/telegram/test", "shortDescription": {"text": "Unused endpoint: POST /api/telegram/test"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/telegram/test` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-67d330fb23ac0d84", "name": "Unused endpoint: PATCH /api/model", "shortDescription": {"text": "Unused endpoint: PATCH /api/model"}, "fullDescription": {"text": "`server/index.js` declares `PATCH /api/model` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-270d1eed4f32185c", "name": "Unused endpoint: POST /api/model/models", "shortDescription": {"text": "Unused endpoint: POST /api/model/models"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/model/models` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a41f854bc18490c0", "name": "Unused endpoint: PATCH /api/connectors/:provider", "shortDescription": {"text": "Unused endpoint: PATCH /api/connectors/:provider"}, "fullDescription": {"text": "`server/index.js` declares `PATCH /api/connectors/:provider` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-351f2db69a21845b", "name": "Unused endpoint: POST /api/tts/voices", "shortDescription": {"text": "Unused endpoint: POST /api/tts/voices"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/tts/voices` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d0cfffd6bfead487", "name": "Unused endpoint: PATCH /api/tts", "shortDescription": {"text": "Unused endpoint: PATCH /api/tts"}, "fullDescription": {"text": "`server/index.js` declares `PATCH /api/tts` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-113592b8c712d973", "name": "Unused endpoint: POST /api/tts/preview", "shortDescription": {"text": "Unused endpoint: POST /api/tts/preview"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/tts/preview` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eece1142a31b70c6", "name": "Unused endpoint: POST /api/telegram/commands", "shortDescription": {"text": "Unused endpoint: POST /api/telegram/commands"}, "fullDescription": {"text": "`server/index.js` declares `POST /api/telegram/commands` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/21605"}, "properties": {"repository": "Transformation-Agency/pillar-brief", "repoUrl": "https://github.com/Transformation-Agency/pillar-brief", "branch": "main"}, "results": [{"ruleId": "scanner-65e3146ddb4311c8", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 server/index.js:3387"}, "properties": {"repobilityId": "21e6b3de2b3dd856", "scanner": "scanner-primary", "fingerprint": "65e3146ddb4311c8", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-22a007ef059ce45f", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/prepare-tauri-sidecar.mjs:1"}, "properties": {"repobilityId": "38a49175c217a0cf", "scanner": "scanner-primary", "fingerprint": "22a007ef059ce45f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/prepare-tauri-sidecar.mjs"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e99fc5c83846214c", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in server/index.js:4"}, "properties": {"repobilityId": "52d97e67169cf06a", "scanner": "scanner-primary", "fingerprint": "e99fc5c83846214c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/index.js"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-904b3471d2cfe95d", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d7d9cd377d591f4e", "scanner": "scanner-primary", "fingerprint": "904b3471d2cfe95d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/windows-build.yml"}, "region": {"startLine": 77}}}]}, {"ruleId": "scanner-3bd1d48a144f5b02", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "6505077fb01f1a7e", "scanner": "scanner-primary", "fingerprint": "3bd1d48a144f5b02", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/windows-build.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-391adb6592443f79", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "94f3ae97389c6632", "scanner": "scanner-primary", "fingerprint": "391adb6592443f79", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/macos-release.yml"}, "region": {"startLine": 165}}}]}, {"ruleId": "scanner-dee297f21d82e978", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "9227157b5fcbcb3f", "scanner": "scanner-primary", "fingerprint": "dee297f21d82e978", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/macos-release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-427a4caf1eb4f830", "level": "note", "message": {"text": "Very large file: server/index.js (4268 lines)"}, "properties": {"repobilityId": "4d84f5062adc96c0", "scanner": "scanner-primary", "fingerprint": "427a4caf1eb4f830", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e64c2d422536680f", "level": "note", "message": {"text": "Very large file: src/main.jsx (2757 lines)"}, "properties": {"repobilityId": "6db83d7f0c142654", "scanner": "scanner-primary", "fingerprint": "e64c2d422536680f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-9d79c4077342a7d0", "level": "warning", "message": {"text": "Runtime service client appears to use placeholder configuration"}, "properties": {"repobilityId": "b6439d14465e13a4", "scanner": "scanner-primary", "fingerprint": "9d79c4077342a7d0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "runtime-config", "service-client", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "38a9ced2cf29941d", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-11825279136b53a3", "level": "warning", "message": {"text": "CI is configured but no tests are detected"}, "properties": {"repobilityId": "b7b839bebd2d5cf9", "scanner": "scanner-primary", "fingerprint": "11825279136b53a3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "ci", "config-theater", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "c3b24fb88231bbf6", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "5ceacf2681bc9ee5", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-a4cddcaa8b169dc6", "level": "note", "message": {"text": "Legacy-named symbol `eleven_multilingual_v2` in server/index.js:175"}, "properties": {"repobilityId": "036a62a4a999be84", "scanner": "scanner-primary", "fingerprint": "a4cddcaa8b169dc6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-f2b89dbfdb650522", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 server/index.js:1173"}, "properties": {"repobilityId": "5ec8a1e1a15aec46", "scanner": "scanner-primary", "fingerprint": "f2b89dbfdb650522", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b00df46cba3baaed", "level": "note", "message": {"text": "Legacy-named symbol `eleven_multilingual_v2` in src/main.jsx:1501"}, "properties": {"repobilityId": "6d124591e973e31f", "scanner": "scanner-primary", "fingerprint": "b00df46cba3baaed", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-87acb4066071a15a", "level": "note", "message": {"text": "19 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "b1f30c58de7ffb20", "scanner": "scanner-primary", "fingerprint": "87acb4066071a15a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-a61eecfbaaf9ac1c", "level": "error", "message": {"text": "Dangling fetch: POST http://${host}:${port}/api/runtime/shutdown (server/index.js:4261)"}, "properties": {"repobilityId": "dd61291c7767986b", "scanner": "scanner-primary", "fingerprint": "a61eecfbaaf9ac1c", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-27652a11ba620012", "level": "note", "message": {"text": "Unused endpoint: GET /api/state"}, "properties": {"repobilityId": "eca6d0c57258efee", "scanner": "scanner-primary", "fingerprint": "27652a11ba620012", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-81e12a447f9a88e1", "level": "note", "message": {"text": "Unused endpoint: GET /api/notifications/latest-brief"}, "properties": {"repobilityId": "9dbc78a87717b369", "scanner": "scanner-primary", "fingerprint": "81e12a447f9a88e1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-db942cb36aafb88d", "level": "note", "message": {"text": "Unused endpoint: POST /api/runtime/shutdown"}, "properties": {"repobilityId": "c5ae2897e48c2068", "scanner": "scanner-primary", "fingerprint": "db942cb36aafb88d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-923125efe30ed7be", "level": "note", "message": {"text": "Unused endpoint: GET /api/runtime/ffmpeg"}, "properties": {"repobilityId": "3c2d6280622944ec", "scanner": "scanner-primary", "fingerprint": "923125efe30ed7be", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9d3fe321a165282b", "level": "note", "message": {"text": "Unused endpoint: GET /api/runtime/stt"}, "properties": {"repobilityId": "9b7e7c8a150690c2", "scanner": "scanner-primary", "fingerprint": "9d3fe321a165282b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-72465f7b65470208", "level": "note", "message": {"text": "Unused endpoint: GET /api/audio/:fileName"}, "properties": {"repobilityId": "95f4234983a7d216", "scanner": "scanner-primary", "fingerprint": "72465f7b65470208", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bcefa1a8972c695c", "level": "note", "message": {"text": "Unused endpoint: POST /api/runtime/stt/model/install"}, "properties": {"repobilityId": "fab5f01005f05a61", "scanner": "scanner-primary", "fingerprint": "bcefa1a8972c695c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d8a44c8f128ab6db", "level": "note", "message": {"text": "Unused endpoint: POST /api/runtime/ffmpeg/install"}, "properties": {"repobilityId": "5925434d9f9592fe", "scanner": "scanner-primary", "fingerprint": "d8a44c8f128ab6db", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8b24b7e392eae52f", "level": "note", "message": {"text": "Unused endpoint: POST /api/runtime/open-url"}, "properties": {"repobilityId": "f0a6bdb4addff258", "scanner": "scanner-primary", "fingerprint": "8b24b7e392eae52f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d948519b70d43868", "level": "note", "message": {"text": "Unused endpoint: GET /api/onboarding"}, "properties": {"repobilityId": "28c29dabc8bf0ed4", "scanner": "scanner-primary", "fingerprint": "d948519b70d43868", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d900292b65fc0212", "level": "note", "message": {"text": "Unused endpoint: PATCH /api/onboarding"}, "properties": {"repobilityId": "5344ee475c33e8f7", "scanner": "scanner-primary", "fingerprint": "d900292b65fc0212", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-24ef6cb8ddddff72", "level": "note", "message": {"text": "Unused endpoint: POST /api/onboarding/brief-setup-draft"}, "properties": {"repobilityId": "47adb2fdfcae3577", "scanner": "scanner-primary", "fingerprint": "24ef6cb8ddddff72", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f60d25f7bc479a78", "level": "note", "message": {"text": "Unused endpoint: POST /api/onboarding/brief-setup-apply"}, "properties": {"repobilityId": "394b7d55761240b4", "scanner": "scanner-primary", "fingerprint": "f60d25f7bc479a78", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e27176dacd4d043a", "level": "note", "message": {"text": "Unused endpoint: POST /api/onboarding/source-suggestions"}, "properties": {"repobilityId": "83a1627fd9131f36", "scanner": "scanner-primary", "fingerprint": "e27176dacd4d043a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-11335877ac584df4", "level": "note", "message": {"text": "Unused endpoint: POST /api/onboarding/complete"}, "properties": {"repobilityId": "d39907eed84fcbdf", "scanner": "scanner-primary", "fingerprint": "11335877ac584df4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3ed9b9a006578a45", "level": "note", "message": {"text": "Unused endpoint: POST /api/onboarding/skip"}, "properties": {"repobilityId": "828a5aecf0ec7727", "scanner": "scanner-primary", "fingerprint": "3ed9b9a006578a45", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-49b52bcb0bcab42c", "level": "note", "message": {"text": "Unused endpoint: POST /api/onboarding/reset"}, "properties": {"repobilityId": "f38d4270a8c1cfc5", "scanner": "scanner-primary", "fingerprint": "49b52bcb0bcab42c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6656b51e8fa7f4dd", "level": "note", "message": {"text": "Unused endpoint: PATCH /api/brief-config"}, "properties": {"repobilityId": "eaba47c32958fc69", "scanner": "scanner-primary", "fingerprint": "6656b51e8fa7f4dd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-63d276bd168250f0", "level": "note", "message": {"text": "Unused endpoint: POST /api/perspective-lenses/generate"}, "properties": {"repobilityId": "75b8b4d397305c88", "scanner": "scanner-primary", "fingerprint": "63d276bd168250f0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fa47b793ab470008", "level": "note", "message": {"text": "Unused endpoint: POST /api/workflow-runs/:id/deliberate"}, "properties": {"repobilityId": "3069b7da079a2757", "scanner": "scanner-primary", "fingerprint": "fa47b793ab470008", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2f560e03ed234dca", "level": "note", "message": {"text": "Unused endpoint: POST /api/sources"}, "properties": {"repobilityId": "17097f4d017ec6c5", "scanner": "scanner-primary", "fingerprint": "2f560e03ed234dca", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6588bdc3eea4e0f9", "level": "note", "message": {"text": "Unused endpoint: POST /api/podcast/resolve-spotify"}, "properties": {"repobilityId": "56fc6dac7cc0195c", "scanner": "scanner-primary", "fingerprint": "6588bdc3eea4e0f9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3e02dc8ba6013b97", "level": "note", "message": {"text": "Unused endpoint: POST /api/sources/:id/transcribe"}, "properties": {"repobilityId": "a25bd2f859b7df67", "scanner": "scanner-primary", "fingerprint": "3e02dc8ba6013b97", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-60cb14b4eeef48dd", "level": "note", "message": {"text": "Unused endpoint: POST /api/sources/:id/fetch-x"}, "properties": {"repobilityId": "1849293db11361f8", "scanner": "scanner-primary", "fingerprint": "60cb14b4eeef48dd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6e5d8e1a57964131", "level": "note", "message": {"text": "Unused endpoint: PATCH /api/sources/:id"}, "properties": {"repobilityId": "76895ac26bdad3af", "scanner": "scanner-primary", "fingerprint": "6e5d8e1a57964131", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a6b4285b486e71e5", "level": "note", "message": {"text": "Unused endpoint: DELETE /api/sources/:id"}, "properties": {"repobilityId": "0d88acb9c8dddf68", "scanner": "scanner-primary", "fingerprint": "a6b4285b486e71e5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1f09896279363b56", "level": "note", "message": {"text": "Unused endpoint: POST /api/lenses"}, "properties": {"repobilityId": "8b41cae7f650d766", "scanner": "scanner-primary", "fingerprint": "1f09896279363b56", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2c686cfe4b6a5eb6", "level": "note", "message": {"text": "Unused endpoint: PATCH /api/lenses/:id"}, "properties": {"repobilityId": "7b1673b694bdbfe3", "scanner": "scanner-primary", "fingerprint": "2c686cfe4b6a5eb6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b6b8916de9128dce", "level": "note", "message": {"text": "Unused endpoint: POST /api/councils"}, "properties": {"repobilityId": "9bca9d929d4b360a", "scanner": "scanner-primary", "fingerprint": "b6b8916de9128dce", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-144a0970f69df2ed", "level": "note", "message": {"text": "Unused endpoint: POST /api/documents"}, "properties": {"repobilityId": "cf7abeac09212f52", "scanner": "scanner-primary", "fingerprint": "144a0970f69df2ed", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bfd68f5ce4a8eca4", "level": "note", "message": {"text": "Unused endpoint: PATCH /api/documents/:id"}, "properties": {"repobilityId": "9df93867e84f22fb", "scanner": "scanner-primary", "fingerprint": "bfd68f5ce4a8eca4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f025e0d8aa4b1c72", "level": "note", "message": {"text": "Unused endpoint: POST /api/workflow-runs"}, "properties": {"repobilityId": "24c29e177faac62b", "scanner": "scanner-primary", "fingerprint": "f025e0d8aa4b1c72", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-feb61e371f8e94a0", "level": "note", "message": {"text": "Unused endpoint: GET /api/workflow-runs/:id"}, "properties": {"repobilityId": "99ac3262ee06b180", "scanner": "scanner-primary", "fingerprint": "feb61e371f8e94a0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7637c348fff99a44", "level": "note", "message": {"text": "Unused endpoint: POST /api/workflow-runs/:id/audio"}, "properties": {"repobilityId": "df059da63c21ad0d", "scanner": "scanner-primary", "fingerprint": "7637c348fff99a44", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b4317839fa76eb54", "level": "note", "message": {"text": "Unused endpoint: PATCH /api/approvals/:id"}, "properties": {"repobilityId": "00a9c4c3995ff970", "scanner": "scanner-primary", "fingerprint": "b4317839fa76eb54", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c2eee0486e3fb45e", "level": "note", "message": {"text": "Unused endpoint: PATCH /api/telegram"}, "properties": {"repobilityId": "33b748db2deadfdb", "scanner": "scanner-primary", "fingerprint": "c2eee0486e3fb45e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fe3ee47768f6dd0c", "level": "note", "message": {"text": "Unused endpoint: POST /api/telegram/token/validate"}, "properties": {"repobilityId": "b045cd00eaa14749", "scanner": "scanner-primary", "fingerprint": "fe3ee47768f6dd0c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3614b6addc94340d", "level": "note", "message": {"text": "Unused endpoint: POST /api/telegram/pairing/start"}, "properties": {"repobilityId": "ec655a651e5774d8", "scanner": "scanner-primary", "fingerprint": "3614b6addc94340d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bc4700f58f7d6692", "level": "note", "message": {"text": "Unused endpoint: GET /api/telegram/pairing/:id"}, "properties": {"repobilityId": "4c3f842351ec168b", "scanner": "scanner-primary", "fingerprint": "bc4700f58f7d6692", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f6750ab3ff58c019", "level": "note", "message": {"text": "Unused endpoint: GET /api/telegram/pairing/:id/qr.svg"}, "properties": {"repobilityId": "3e37d2500c544daf", "scanner": "scanner-primary", "fingerprint": "f6750ab3ff58c019", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bcbcf10216b61e0d", "level": "note", "message": {"text": "Unused endpoint: POST /api/telegram/pairing/:id/poll"}, "properties": {"repobilityId": "02c329ca95bfb415", "scanner": "scanner-primary", "fingerprint": "bcbcf10216b61e0d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5cd15a93098bfa5f", "level": "note", "message": {"text": "Unused endpoint: POST /api/telegram/test"}, "properties": {"repobilityId": "6df8c0198b7a5e60", "scanner": "scanner-primary", "fingerprint": "5cd15a93098bfa5f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-67d330fb23ac0d84", "level": "note", "message": {"text": "Unused endpoint: PATCH /api/model"}, "properties": {"repobilityId": "645f11e076e521ec", "scanner": "scanner-primary", "fingerprint": "67d330fb23ac0d84", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-270d1eed4f32185c", "level": "note", "message": {"text": "Unused endpoint: POST /api/model/models"}, "properties": {"repobilityId": "45ef167cc373f7c2", "scanner": "scanner-primary", "fingerprint": "270d1eed4f32185c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a41f854bc18490c0", "level": "note", "message": {"text": "Unused endpoint: PATCH /api/connectors/:provider"}, "properties": {"repobilityId": "c7e5af7ad546cc1e", "scanner": "scanner-primary", "fingerprint": "a41f854bc18490c0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-351f2db69a21845b", "level": "note", "message": {"text": "Unused endpoint: POST /api/tts/voices"}, "properties": {"repobilityId": "641b64ea4c15f430", "scanner": "scanner-primary", "fingerprint": "351f2db69a21845b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d0cfffd6bfead487", "level": "note", "message": {"text": "Unused endpoint: PATCH /api/tts"}, "properties": {"repobilityId": "bd1c729b64a0d444", "scanner": "scanner-primary", "fingerprint": "d0cfffd6bfead487", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-113592b8c712d973", "level": "note", "message": {"text": "Unused endpoint: POST /api/tts/preview"}, "properties": {"repobilityId": "c105d26a81d1a3e7", "scanner": "scanner-primary", "fingerprint": "113592b8c712d973", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-eece1142a31b70c6", "level": "note", "message": {"text": "Unused endpoint: POST /api/telegram/commands"}, "properties": {"repobilityId": "1b31d54a2d30f6cd", "scanner": "scanner-primary", "fingerprint": "eece1142a31b70c6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}