{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-90cef24f831ba55a", "name": "Possibly dead Python function: test_anthropic", "shortDescription": {"text": "Possibly dead Python function: test_anthropic"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c068d55c09fb09bd", "name": "Possibly dead Python function: test_gemini", "shortDescription": {"text": "Possibly dead Python function: test_gemini"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9f97cef14ac3ac5f", "name": "Possibly dead Python function: decorator", "shortDescription": {"text": "Possibly dead Python function: decorator"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cfd8abb096fff619", "name": "Possibly dead Python function: test_openrouter", "shortDescription": {"text": "Possibly dead Python function: test_openrouter"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e3a5f695561cfa29", "name": "Possibly dead Python function: print_gate_summary", "shortDescription": {"text": "Possibly dead Python function: print_gate_summary"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dfc184b59b8c275d", "name": "Possibly dead Python function: run_agent_loop", "shortDescription": {"text": "Possibly dead Python function: run_agent_loop"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-365c36e191913370", "name": "Possibly dead Python function: quick_extract", "shortDescription": {"text": "Possibly dead Python function: quick_extract"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-54604e10f3c09abb", "name": "Possibly dead Python function: batch_extract", "shortDescription": {"text": "Possibly dead Python function: batch_extract"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7483eee877f12f35", "name": "Possibly dead Python function: to_openai_schema", "shortDescription": {"text": "Possibly dead Python function: to_openai_schema"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-71505c2c92a413dd", "name": "Possibly dead Python function: add_local_model", "shortDescription": {"text": "Possibly dead Python function: add_local_model"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3612e6b385564b07", "name": "Possibly dead Python function: handle_models_list_request", "shortDescription": {"text": "Possibly dead Python function: handle_models_list_request"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-38e014cf72c8c923", "name": "Possibly dead Python function: handle_models_retrieve_request", "shortDescription": {"text": "Possibly dead Python function: handle_models_retrieve_request"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b8ceca1380084387", "name": "Possibly dead Python function: handle_models_compare_request", "shortDescription": {"text": "Possibly dead Python function: handle_models_compare_request"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a55bd831f72ff552", "name": "Possibly dead Python function: handle_models_recommend_request", "shortDescription": {"text": "Possibly dead Python function: handle_models_recommend_request"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d63da3583b14afc0", "name": "Dockerfile runs as root: Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5c7c6e13797d6d4a", "name": "Docker base image is tag-pinned but not digest-pinned: nvidia/cuda:12.1.0-base-ubuntu22.04", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: nvidia/cuda:12.1.0-base-ubuntu22.04"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-876c65ffdaa70dcd", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cdab5ac67e7a717d", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v2 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-46c644c6227e4d4a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-849d05c5f6d90351", "name": "Very large file: src/tools/storyboard/epiphan_presets.py (2691 lines)", "shortDescription": {"text": "Very large file: src/tools/storyboard/epiphan_presets.py (2691 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e88c7eb815109932", "name": "Very large file: src/tools/storyboard/gemini_client.py (1326 lines)", "shortDescription": {"text": "Very large file: src/tools/storyboard/gemini_client.py (1326 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a7b590f4fd04afb7", "name": "Very large file: src/tools/storyboard/vertical_surveys.py (1457 lines)", "shortDescription": {"text": "Very large file: src/tools/storyboard/vertical_surveys.py (1457 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 129 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 22 placeholder/mock markers across 7 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8fe3d3cb07b80ec6", "name": "Agent authority lacks a verifier contract: .claude/hooks.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/hooks.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-11ac25a3c6aea102", "name": "Agent authority lacks a verifier contract: .claude/observers/QUALITY.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/observers/QUALITY.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bcdadd0794d55d6d", "name": "Agent authority lacks a verifier contract: .claude/observers/ARCH.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/observers/ARCH.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8b753e05bcea8470", "name": "Agent authority lacks a verifier contract: .claude/commands/go.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/go.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-81d497f7371fda12", "name": "Agent authority lacks a verifier contract: .claude/commands/simplify.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/simplify.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-53ce696c83aabd74", "name": "Agent authority lacks a verifier contract: .claude/commands/status.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/status.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-77d2e0d3cff65aff", "name": "Agent authority lacks a verifier contract: .claude/commands/interrupt.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/interrupt.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fdfb538ba790e2d3", "name": "Agent authority lacks a verifier contract: .claude/commands/ship.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/ship.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9bf971fb959c1bd9", "name": "Agent authority lacks a verifier contract: .claude/commands/review.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/review.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cd4711f98aa1febf", "name": "Commented-code block (6 lines) in tests/demo/test_router.py:458", "shortDescription": {"text": "Commented-code block (6 lines) in tests/demo/test_router.py:458"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c4641a3838afefad", "name": "Legacy-named symbol `test_find_hero_competitors_empty_for_clean_copy` in tests/tools/storyboard/test_quality_gate_brand.", "shortDescription": {"text": "Legacy-named symbol `test_find_hero_competitors_empty_for_clean_copy` in tests/tools/storyboard/test_quality_gate_brand.py:119"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-549fc26637583ee3", "name": "Commented-code block (6 lines) in tests/tools/storyboard/test_gemini_client.py:732", "shortDescription": {"text": "Commented-code block (6 lines) in tests/tools/storyboard/test_gemini_client.py:732"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-873dc67b29beb7ed", "name": "Commented-code block (5 lines) in tests/tools/storyboard/test_prompt_builders.py:236", "shortDescription": {"text": "Commented-code block (5 lines) in tests/tools/storyboard/test_prompt_builders.py:236"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0e8aa4ecd9b57b2e", "name": "Commented-code block (5 lines) in src/demo/router.py:37", "shortDescription": {"text": "Commented-code block (5 lines) in src/demo/router.py:37"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4b375d3280190f20", "name": "Commented-code block (8 lines) in src/tools/storyboard/epiphan_presets.py:22", "shortDescription": {"text": "Commented-code block (8 lines) in src/tools/storyboard/epiphan_presets.py:22"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-499230be8944c364", "name": "Commented-code block (5 lines) in src/tools/storyboard/prompt_builders.py:186", "shortDescription": {"text": "Commented-code block (5 lines) in src/tools/storyboard/prompt_builders.py:186"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7f02862c5c088864", "name": "Commented-code block (6 lines) in src/tools/storyboard/unified_storyboard.py:580", "shortDescription": {"text": "Commented-code block (6 lines) in src/tools/storyboard/unified_storyboard.py:580"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-27714dfae3b5dca0", "name": "Legacy-named symbol `model_copy` in src/tools/storyboard/gemini_client.py:795", "shortDescription": {"text": "Legacy-named symbol `model_copy` in src/tools/storyboard/gemini_client.py:795"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ab16d52b4e1140d5", "name": "Commented-code block (5 lines) in src/tools/storyboard/gemini_client.py:230", "shortDescription": {"text": "Commented-code block (5 lines) in src/tools/storyboard/gemini_client.py:230"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-379807221de52630", "name": "Commented-code block (5 lines) in src/tools/storyboard/transcript_compactor.py:371", "shortDescription": {"text": "Commented-code block (5 lines) in src/tools/storyboard/transcript_compactor.py:371"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3743ca33aff097d7", "name": "Commented-code block (6 lines) in src/tools/storyboard/meeting_recap.py:199", "shortDescription": {"text": "Commented-code block (6 lines) in src/tools/storyboard/meeting_recap.py:199"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d785c17821858dcb", "name": "22 env vars used in code but missing from .env.example", "shortDescription": {"text": "22 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `CATALOG_INCLUDE_LOCAL`, `CATALOG_INCLUDE_PRICING`, `CLASSIFIER_LLM_MODEL`, `GONG_CLIENT_ID`, `GONG_CLIENT_SECRET`, `OAUTH_REDIRECT_URI`, `QUOTA_BASIC_DAILY`, `QUOTA_BASIC_HOURLY` + 14 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49c98f7cedd9c977", "name": "Near-duplicate function bodies in 4 places", "shortDescription": {"text": "Near-duplicate function bodies in 4 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nshared/providers/anthropic.py:analyze_image, shared/providers/gemini.py:analyze_image, shared/providers/base.py:analyze_image, shared/providers/openrouter.py:analyze_image\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nshared/providers/base.py:get_available_models, shared/providers/base.py:get\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-02525d39071dd2c7", "name": "Near-duplicate function bodies in 5 places", "shortDescription": {"text": "Near-duplicate function bodies in 5 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nshared/agents/tools.py:execute, shared/agents/tools.py:execute, shared/agents/tools.py:execute, shared/agents/tools.py:execute\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-76a2f6818267a9a8", "name": "Near-duplicate function bodies in 8 places", "shortDescription": {"text": "Near-duplicate function bodies in 8 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nsrc/router/chains.py:chain_type, src/router/chains.py:chain_type, src/router/chains.py:chain_type, src/router/chains.py:chain_type\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nsrc/connectors/fireflies/connector.py:get_required_config_fields, src/connectors/close/connector.py:get_required_config_fields, src/connectors/hubspot/connector.py:get_required_config_fields\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b6ad645aba6f9b1c", "name": "FastAPI POST `run_agent` without auth dependency \u2014 src/api.py:223", "shortDescription": {"text": "FastAPI POST `run_agent` without auth dependency \u2014 src/api.py:223"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-117b29a0cb7791fc", "name": "FastAPI POST `cancel_session` without auth dependency \u2014 src/api.py:315", "shortDescription": {"text": "FastAPI POST `cancel_session` without auth dependency \u2014 src/api.py:315"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7c67eda688d8c800", "name": "FastAPI POST `generate_storyboard` without auth dependency \u2014 src/demo/router.py:337", "shortDescription": {"text": "FastAPI POST `generate_storyboard` without auth dependency \u2014 src/demo/router.py:337"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5dc8c3b775f70cc5", "name": "FastAPI POST `route_task` without auth dependency \u2014 src/router/api.py:174", "shortDescription": {"text": "FastAPI POST `route_task` without auth dependency \u2014 src/router/api.py:174"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-45379af1a2b03453", "name": "FastAPI POST `start_demo_pipeline` without auth dependency \u2014 src/tools/video/demo_pipeline_router.py:220", "shortDescription": {"text": "FastAPI POST `start_demo_pipeline` without auth dependency \u2014 src/tools/video/demo_pipeline_router.py:220"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d8da0e0514a28ae2", "name": "FastAPI POST `generate_code_storyboard` without auth dependency \u2014 src/storyboard/router.py:338", "shortDescription": {"text": "FastAPI POST `generate_code_storyboard` without auth dependency \u2014 src/storyboard/router.py:338"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a0ffa9b6876a5bea", "name": "FastAPI POST `generate_roadmap_storyboard` without auth dependency \u2014 src/storyboard/router.py:381", "shortDescription": {"text": "FastAPI POST `generate_roadmap_storyboard` without auth dependency \u2014 src/storyboard/router.py:381"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c7a5d52f4924b693", "name": "FastAPI POST `generate_transcript_storyboard` without auth dependency \u2014 src/storyboard/router.py:424", "shortDescription": {"text": "FastAPI POST `generate_transcript_storyboard` without auth dependency \u2014 src/storyboard/router.py:424"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b6c481c5da6f79ce", "name": "FastAPI POST `generate_meeting_recap` without auth dependency \u2014 src/storyboard/router.py:509", "shortDescription": {"text": "FastAPI POST `generate_meeting_recap` without auth dependency \u2014 src/storyboard/router.py:509"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-85da5ad1156cb208", "name": "FastAPI POST `submit_survey` without auth dependency \u2014 src/storyboard/router.py:696", "shortDescription": {"text": "FastAPI POST `submit_survey` without auth dependency \u2014 src/storyboard/router.py:696"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9b01bb989de3c13a", "name": "FastAPI POST `start_oauth` without auth dependency \u2014 src/routers/connectors.py:602", "shortDescription": {"text": "FastAPI POST `start_oauth` without auth dependency \u2014 src/routers/connectors.py:602"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-30a66a4a4b8c5d8d", "name": "FastAPI POST `connect_api_key` without auth dependency \u2014 src/routers/connectors.py:743", "shortDescription": {"text": "FastAPI POST `connect_api_key` without auth dependency \u2014 src/routers/connectors.py:743"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-04bb971f86037ea5", "name": "FastAPI POST `trigger_sync` without auth dependency \u2014 src/routers/connectors.py:841", "shortDescription": {"text": "FastAPI POST `trigger_sync` without auth dependency \u2014 src/routers/connectors.py:841"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2c966e250d9bf844", "name": "FastAPI DELETE `disconnect` without auth dependency \u2014 src/routers/connectors.py:983", "shortDescription": {"text": "FastAPI DELETE `disconnect` without auth dependency \u2014 src/routers/connectors.py:983"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c17e3c05c30da224", "name": "FastAPI POST `manual_upload` without auth dependency \u2014 src/routers/connectors.py:1033", "shortDescription": {"text": "FastAPI POST `manual_upload` without auth dependency \u2014 src/routers/connectors.py:1033"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`src/api.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f7157dfa53a5b604", "name": "Unused endpoint: POST /agents/run", "shortDescription": {"text": "Unused endpoint: POST /agents/run"}, "fullDescription": {"text": "`src/api.py` declares `POST /agents/run` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fb6fad685bfa9ff7", "name": "Unused endpoint: GET /agents/{session_id}", "shortDescription": {"text": "Unused endpoint: GET /agents/{session_id}"}, "fullDescription": {"text": "`src/api.py` declares `GET /agents/{session_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-65323861d802e87e", "name": "Unused endpoint: POST /agents/{session_id}/cancel", "shortDescription": {"text": "Unused endpoint: POST /agents/{session_id}/cancel"}, "fullDescription": {"text": "`src/api.py` declares `POST /agents/{session_id}/cancel` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-582b00fca2796501", "name": "Unused endpoint: GET /tools", "shortDescription": {"text": "Unused endpoint: GET /tools"}, "fullDescription": {"text": "`src/api.py` declares `GET /tools` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0bb20633b766f2c8", "name": "Unused endpoint: GET /options", "shortDescription": {"text": "Unused endpoint: GET /options"}, "fullDescription": {"text": "`src/demo/router.py` declares `GET /options` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cb92e9ce17198528", "name": "Unused endpoint: GET /examples", "shortDescription": {"text": "Unused endpoint: GET /examples"}, "fullDescription": {"text": "`src/demo/router.py` declares `GET /examples` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-57d4028fa73def44", "name": "Unused endpoint: GET /examples/{name}", "shortDescription": {"text": "Unused endpoint: GET /examples/{name}"}, "fullDescription": {"text": "`src/demo/router.py` declares `GET /examples/{name}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-970eb92d6ec2bfaa", "name": "Unused endpoint: POST /generate", "shortDescription": {"text": "Unused endpoint: POST /generate"}, "fullDescription": {"text": "`src/demo/router.py` declares `POST /generate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-126cf9ba887887cc", "name": "Unused endpoint: GET /fonts.css", "shortDescription": {"text": "Unused endpoint: GET /fonts.css"}, "fullDescription": {"text": "`src/brand/fonts.py` declares `GET /fonts.css` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-227c1a502b5e8189", "name": "Unused endpoint: GET /font/{key}.otf", "shortDescription": {"text": "Unused endpoint: GET /font/{key}.otf"}, "fullDescription": {"text": "`src/brand/fonts.py` declares `GET /font/{key}.otf` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a009b1a56794f45", "name": "Unused endpoint: POST /", "shortDescription": {"text": "Unused endpoint: POST /"}, "fullDescription": {"text": "`src/router/api.py` declares `POST /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-28e338a59684caeb", "name": "Unused endpoint: GET /chains", "shortDescription": {"text": "Unused endpoint: GET /chains"}, "fullDescription": {"text": "`src/router/api.py` declares `GET /chains` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be673e0aa1be827a", "name": "Unused endpoint: GET /{job_id}", "shortDescription": {"text": "Unused endpoint: GET /{job_id}"}, "fullDescription": {"text": "`src/router/api.py` declares `GET /{job_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cef303b904ddfef8", "name": "Unused endpoint: POST /demo-pipeline", "shortDescription": {"text": "Unused endpoint: POST /demo-pipeline"}, "fullDescription": {"text": "`src/tools/video/demo_pipeline_router.py` declares `POST /demo-pipeline` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e8eb05238798dd33", "name": "Unused endpoint: GET /demo-pipeline/jobs/{job_id}", "shortDescription": {"text": "Unused endpoint: GET /demo-pipeline/jobs/{job_id}"}, "fullDescription": {"text": "`src/tools/video/demo_pipeline_router.py` declares `GET /demo-pipeline/jobs/{job_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e9ca4e347c1cab3a", "name": "Unused endpoint: POST /code", "shortDescription": {"text": "Unused endpoint: POST /code"}, "fullDescription": {"text": "`src/storyboard/router.py` declares `POST /code` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-114278f28f36ace6", "name": "Unused endpoint: POST /roadmap", "shortDescription": {"text": "Unused endpoint: POST /roadmap"}, "fullDescription": {"text": "`src/storyboard/router.py` declares `POST /roadmap` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d170c29d3a4bce09", "name": "Unused endpoint: POST /transcript", "shortDescription": {"text": "Unused endpoint: POST /transcript"}, "fullDescription": {"text": "`src/storyboard/router.py` declares `POST /transcript` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ee53a8b03729481e", "name": "Unused endpoint: GET /jobs/{job_id}", "shortDescription": {"text": "Unused endpoint: GET /jobs/{job_id}"}, "fullDescription": {"text": "`src/storyboard/router.py` declares `GET /jobs/{job_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5231dc73c9d28c11", "name": "Unused endpoint: POST /meeting-recap", "shortDescription": {"text": "Unused endpoint: POST /meeting-recap"}, "fullDescription": {"text": "`src/storyboard/router.py` declares `POST /meeting-recap` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-71fdfae11fc560ed", "name": "Unused endpoint: GET /survey/templates/{vertical}", "shortDescription": {"text": "Unused endpoint: GET /survey/templates/{vertical}"}, "fullDescription": {"text": "`src/storyboard/router.py` declares `GET /survey/templates/{vertical}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-85eeccd2ba9bad7a", "name": "Unused endpoint: POST /survey/submit", "shortDescription": {"text": "Unused endpoint: POST /survey/submit"}, "fullDescription": {"text": "`src/storyboard/router.py` declares `POST /survey/submit` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-09db04339472cc4e", "name": "Unused endpoint: GET /instances", "shortDescription": {"text": "Unused endpoint: GET /instances"}, "fullDescription": {"text": "`src/routers/connectors.py` declares `GET /instances` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd313f34383e32b5", "name": "Unused endpoint: GET /instances/{instance_id}", "shortDescription": {"text": "Unused endpoint: GET /instances/{instance_id}"}, "fullDescription": {"text": "`src/routers/connectors.py` declares `GET /instances/{instance_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-935e92ed7330d84c", "name": "Unused endpoint: POST /{connector_type}/oauth/authorize", "shortDescription": {"text": "Unused endpoint: POST /{connector_type}/oauth/authorize"}, "fullDescription": {"text": "`src/routers/connectors.py` declares `POST /{connector_type}/oauth/authorize` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3f945bfe87d63c9a", "name": "Unused endpoint: POST /{connector_type}/oauth/callback", "shortDescription": {"text": "Unused endpoint: POST /{connector_type}/oauth/callback"}, "fullDescription": {"text": "`src/routers/connectors.py` declares `POST /{connector_type}/oauth/callback` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-07173efac5fdc1c1", "name": "Unused endpoint: POST /{connector_type}/connect", "shortDescription": {"text": "Unused endpoint: POST /{connector_type}/connect"}, "fullDescription": {"text": "`src/routers/connectors.py` declares `POST /{connector_type}/connect` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3fffc6def5524181", "name": "Unused endpoint: POST /instances/{instance_id}/sync", "shortDescription": {"text": "Unused endpoint: POST /instances/{instance_id}/sync"}, "fullDescription": {"text": "`src/routers/connectors.py` declares `POST /instances/{instance_id}/sync` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3dcb7fdd20190ddb", "name": "Unused endpoint: GET /instances/{instance_id}/sync-history", "shortDescription": {"text": "Unused endpoint: GET /instances/{instance_id}/sync-history"}, "fullDescription": {"text": "`src/routers/connectors.py` declares `GET /instances/{instance_id}/sync-history` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f054b1a90878f66c", "name": "Unused endpoint: DELETE /instances/{instance_id}", "shortDescription": {"text": "Unused endpoint: DELETE /instances/{instance_id}"}, "fullDescription": {"text": "`src/routers/connectors.py` declares `DELETE /instances/{instance_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9ceb38ccbe61dc41", "name": "Unused endpoint: POST /instances/{instance_id}/upload", "shortDescription": {"text": "Unused endpoint: POST /instances/{instance_id}/upload"}, "fullDescription": {"text": "`src/routers/connectors.py` declares `POST /instances/{instance_id}/upload` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/19063"}, "properties": {"repository": "ScientiaCapital/epiphan-storyboard", "repoUrl": "https://github.com/ScientiaCapital/epiphan-storyboard", "branch": "main"}, "results": [{"ruleId": "scanner-90cef24f831ba55a", "level": "note", "message": {"text": "Possibly dead Python function: test_anthropic"}, "properties": {"repobilityId": "538afb5e42099573", "scanner": "scanner-primary", "fingerprint": "90cef24f831ba55a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shared/providers/anthropic.py:193"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c068d55c09fb09bd", "level": "note", "message": {"text": "Possibly dead Python function: test_gemini"}, "properties": {"repobilityId": "a51c2913e71e5564", "scanner": "scanner-primary", "fingerprint": "c068d55c09fb09bd", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shared/providers/gemini.py:194"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9f97cef14ac3ac5f", "level": "note", "message": {"text": "Possibly dead Python function: decorator"}, "properties": {"repobilityId": "ffbcbc9bc189af1c", "scanner": "scanner-primary", "fingerprint": "9f97cef14ac3ac5f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shared/providers/base.py:521"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cfd8abb096fff619", "level": "note", "message": {"text": "Possibly dead Python function: test_openrouter"}, "properties": {"repobilityId": "bc3e22f2d93d797d", "scanner": "scanner-primary", "fingerprint": "cfd8abb096fff619", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shared/providers/openrouter.py:197"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e3a5f695561cfa29", "level": "note", "message": {"text": "Possibly dead Python function: print_gate_summary"}, "properties": {"repobilityId": "324ec3d1b85da279", "scanner": "scanner-primary", "fingerprint": "e3a5f695561cfa29", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shared/audit/logger.py:277"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dfc184b59b8c275d", "level": "note", "message": {"text": "Possibly dead Python function: run_agent_loop"}, "properties": {"repobilityId": "8466f762193353d4", "scanner": "scanner-primary", "fingerprint": "dfc184b59b8c275d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shared/agents/orchestrator.py:273"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-365c36e191913370", "level": "note", "message": {"text": "Possibly dead Python function: quick_extract"}, "properties": {"repobilityId": "9320d6e0f007a795", "scanner": "scanner-primary", "fingerprint": "365c36e191913370", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shared/agents/orchestrator.py:576"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-54604e10f3c09abb", "level": "note", "message": {"text": "Possibly dead Python function: batch_extract"}, "properties": {"repobilityId": "e4757314a252e003", "scanner": "scanner-primary", "fingerprint": "54604e10f3c09abb", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shared/agents/orchestrator.py:596"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7483eee877f12f35", "level": "note", "message": {"text": "Possibly dead Python function: to_openai_schema"}, "properties": {"repobilityId": "d6bc25c518bd8183", "scanner": "scanner-primary", "fingerprint": "7483eee877f12f35", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shared/agents/schema.py:165"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-71505c2c92a413dd", "level": "note", "message": {"text": "Possibly dead Python function: add_local_model"}, "properties": {"repobilityId": "b4bc2a365fbc75ec", "scanner": "scanner-primary", "fingerprint": "71505c2c92a413dd", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/model_catalog.py:582"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3612e6b385564b07", "level": "note", "message": {"text": "Possibly dead Python function: handle_models_list_request"}, "properties": {"repobilityId": "808632ce025709e7", "scanner": "scanner-primary", "fingerprint": "3612e6b385564b07", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/model_catalog.py:689"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-38e014cf72c8c923", "level": "note", "message": {"text": "Possibly dead Python function: handle_models_retrieve_request"}, "properties": {"repobilityId": "d53450e9db79eb45", "scanner": "scanner-primary", "fingerprint": "38e014cf72c8c923", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/model_catalog.py:705"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b8ceca1380084387", "level": "note", "message": {"text": "Possibly dead Python function: handle_models_compare_request"}, "properties": {"repobilityId": "0e7b5a5eb6ab91d9", "scanner": "scanner-primary", "fingerprint": "b8ceca1380084387", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/model_catalog.py:716"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a55bd831f72ff552", "level": "note", "message": {"text": "Possibly dead Python function: handle_models_recommend_request"}, "properties": {"repobilityId": "f8567a1cfe28e275", "scanner": "scanner-primary", "fingerprint": "a55bd831f72ff552", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/model_catalog.py:722"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d63da3583b14afc0", "level": "warning", "message": {"text": "Dockerfile runs as root: Dockerfile"}, "properties": {"repobilityId": "a2ed1bd120e507db", "scanner": "scanner-primary", "fingerprint": "d63da3583b14afc0", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-5c7c6e13797d6d4a", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: nvidia/cuda:12.1.0-base-ubuntu22.04"}, "properties": {"repobilityId": "640f3f03512e5953", "scanner": "scanner-primary", "fingerprint": "5c7c6e13797d6d4a", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-876c65ffdaa70dcd", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d573d6491806077b", "scanner": "scanner-primary", "fingerprint": "876c65ffdaa70dcd", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/dev.yml"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-876c65ffdaa70dcd", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c505f487c65d608a", "scanner": "scanner-primary", "fingerprint": "876c65ffdaa70dcd", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/dev.yml"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-876c65ffdaa70dcd", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5fdc9ddebd47c5da", "scanner": "scanner-primary", "fingerprint": "876c65ffdaa70dcd", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/dev.yml"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-876c65ffdaa70dcd", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b9f5fb509f2fa8ed", "scanner": "scanner-primary", "fingerprint": "876c65ffdaa70dcd", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/dev.yml"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-876c65ffdaa70dcd", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5b576b03137954d2", "scanner": "scanner-primary", "fingerprint": "876c65ffdaa70dcd", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/dev.yml"}, "region": {"startLine": 38}}}]}, {"ruleId": "scanner-876c65ffdaa70dcd", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "da753080d26100e2", "scanner": "scanner-primary", "fingerprint": "876c65ffdaa70dcd", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/dev.yml"}, "region": {"startLine": 53}}}]}, {"ruleId": "scanner-cdab5ac67e7a717d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "834d615f066c4bf0", "scanner": "scanner-primary", "fingerprint": "cdab5ac67e7a717d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/CI-runpod_dep.yml"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-cdab5ac67e7a717d", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4082f82b98527b34", "scanner": "scanner-primary", "fingerprint": "cdab5ac67e7a717d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/CI-runpod_dep.yml"}, "region": {"startLine": 61}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "51597ecccc1bdb97", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b3c800471aacaf03", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "15b01c1e36e9f12b", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c71c4053464cd39c", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 38}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3c9963ef94485864", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 44}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ead4740091f1a151", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 68}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-849d05c5f6d90351", "level": "note", "message": {"text": "Very large file: src/tools/storyboard/epiphan_presets.py (2691 lines)"}, "properties": {"repobilityId": "6d778043819bd8db", "scanner": "scanner-primary", "fingerprint": "849d05c5f6d90351", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e88c7eb815109932", "level": "note", "message": {"text": "Very large file: src/tools/storyboard/gemini_client.py (1326 lines)"}, "properties": {"repobilityId": "f4f3aa5b92bb7f01", "scanner": "scanner-primary", "fingerprint": "e88c7eb815109932", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a7b590f4fd04afb7", "level": "note", "message": {"text": "Very large file: src/tools/storyboard/vertical_surveys.py (1457 lines)"}, "properties": {"repobilityId": "691c99bfe74eb139", "scanner": "scanner-primary", "fingerprint": "a7b590f4fd04afb7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "4921732d131841f5", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "b018466956a449b5", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "3f18017af056d14d", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "22873c9f2d4349d5", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "305f0d5de773a7bd", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8fe3d3cb07b80ec6", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/hooks.json"}, "properties": {"repobilityId": "bcbcb6279e8ed224", "scanner": "scanner-primary", "fingerprint": "8fe3d3cb07b80ec6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/hooks.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-11ac25a3c6aea102", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/observers/QUALITY.md"}, "properties": {"repobilityId": "dd1d181d797575ce", "scanner": "scanner-primary", "fingerprint": "11ac25a3c6aea102", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/observers/QUALITY.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bcdadd0794d55d6d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/observers/ARCH.md"}, "properties": {"repobilityId": "7121f791adaabcb1", "scanner": "scanner-primary", "fingerprint": "bcdadd0794d55d6d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/observers/ARCH.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8b753e05bcea8470", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/go.md"}, "properties": {"repobilityId": "caf28836b235ca5a", "scanner": "scanner-primary", "fingerprint": "8b753e05bcea8470", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/go.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-81d497f7371fda12", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/simplify.md"}, "properties": {"repobilityId": "af1656377f2838a7", "scanner": "scanner-primary", "fingerprint": "81d497f7371fda12", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/simplify.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-53ce696c83aabd74", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/status.md"}, "properties": {"repobilityId": "88aae42dcbdf6a24", "scanner": "scanner-primary", "fingerprint": "53ce696c83aabd74", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/status.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-77d2e0d3cff65aff", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/interrupt.md"}, "properties": {"repobilityId": "8b5884890c90f30b", "scanner": "scanner-primary", "fingerprint": "77d2e0d3cff65aff", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/interrupt.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fdfb538ba790e2d3", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/ship.md"}, "properties": {"repobilityId": "65c65a13ec0a146d", "scanner": "scanner-primary", "fingerprint": "fdfb538ba790e2d3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/ship.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9bf971fb959c1bd9", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/review.md"}, "properties": {"repobilityId": "b1e28d266fdfdeb8", "scanner": "scanner-primary", "fingerprint": "9bf971fb959c1bd9", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/review.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cd4711f98aa1febf", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/demo/test_router.py:458"}, "properties": {"repobilityId": "cf4d3b6f1d7a94e0", "scanner": "scanner-primary", "fingerprint": "cd4711f98aa1febf", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c4641a3838afefad", "level": "note", "message": {"text": "Legacy-named symbol `test_find_hero_competitors_empty_for_clean_copy` in tests/tools/storyboard/test_quality_gate_brand.py:119"}, "properties": {"repobilityId": "1292c9cd070b3ba1", "scanner": "scanner-primary", "fingerprint": "c4641a3838afefad", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-549fc26637583ee3", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/tools/storyboard/test_gemini_client.py:732"}, "properties": {"repobilityId": "074b326f222a3f7f", "scanner": "scanner-primary", "fingerprint": "549fc26637583ee3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-873dc67b29beb7ed", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/tools/storyboard/test_prompt_builders.py:236"}, "properties": {"repobilityId": "4a465e3a494183e8", "scanner": "scanner-primary", "fingerprint": "873dc67b29beb7ed", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0e8aa4ecd9b57b2e", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/demo/router.py:37"}, "properties": {"repobilityId": "2bc42c1487bd6ae3", "scanner": "scanner-primary", "fingerprint": "0e8aa4ecd9b57b2e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4b375d3280190f20", "level": "none", "message": {"text": "Commented-code block (8 lines) in src/tools/storyboard/epiphan_presets.py:22"}, "properties": {"repobilityId": "698e7ef6fafe4e49", "scanner": "scanner-primary", "fingerprint": "4b375d3280190f20", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-499230be8944c364", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/tools/storyboard/prompt_builders.py:186"}, "properties": {"repobilityId": "4110b3234e878e72", "scanner": "scanner-primary", "fingerprint": "499230be8944c364", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7f02862c5c088864", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/tools/storyboard/unified_storyboard.py:580"}, "properties": {"repobilityId": "41831475150d74c5", "scanner": "scanner-primary", "fingerprint": "7f02862c5c088864", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-27714dfae3b5dca0", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in src/tools/storyboard/gemini_client.py:795"}, "properties": {"repobilityId": "395d9028181467a6", "scanner": "scanner-primary", "fingerprint": "27714dfae3b5dca0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-ab16d52b4e1140d5", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/tools/storyboard/gemini_client.py:230"}, "properties": {"repobilityId": "8f7bd8ee16b747aa", "scanner": "scanner-primary", "fingerprint": "ab16d52b4e1140d5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-379807221de52630", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/tools/storyboard/transcript_compactor.py:371"}, "properties": {"repobilityId": "dd85abeb3cbadb0c", "scanner": "scanner-primary", "fingerprint": "379807221de52630", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3743ca33aff097d7", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/tools/storyboard/meeting_recap.py:199"}, "properties": {"repobilityId": "22a2d43dcc64393f", "scanner": "scanner-primary", "fingerprint": "3743ca33aff097d7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d785c17821858dcb", "level": "note", "message": {"text": "22 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "f5222babac44ad42", "scanner": "scanner-primary", "fingerprint": "d785c17821858dcb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "232305e4b4e2e390", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "835108e4f691db0b", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-02525d39071dd2c7", "level": "note", "message": {"text": "Near-duplicate function bodies in 5 places"}, "properties": {"repobilityId": "7677a12a3f8c5d57", "scanner": "scanner-primary", "fingerprint": "02525d39071dd2c7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-02525d39071dd2c7", "level": "note", "message": {"text": "Near-duplicate function bodies in 5 places"}, "properties": {"repobilityId": "f7c92e4b6aac3c9a", "scanner": "scanner-primary", "fingerprint": "02525d39071dd2c7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "f81149dd9758368b", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "dbc81876e478f178", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "4c3f937dae7964e1", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-76a2f6818267a9a8", "level": "note", "message": {"text": "Near-duplicate function bodies in 8 places"}, "properties": {"repobilityId": "fd251367d20c9974", "scanner": "scanner-primary", "fingerprint": "76a2f6818267a9a8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-76a2f6818267a9a8", "level": "note", "message": {"text": "Near-duplicate function bodies in 8 places"}, "properties": {"repobilityId": "49652841cbccc69b", "scanner": "scanner-primary", "fingerprint": "76a2f6818267a9a8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-76a2f6818267a9a8", "level": "note", "message": {"text": "Near-duplicate function bodies in 8 places"}, "properties": {"repobilityId": "cf5756ab8c6c6ba2", "scanner": "scanner-primary", "fingerprint": "76a2f6818267a9a8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "eee3c8edc82c9223", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "fd0bb461f0a5aa7e", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "e1e600ccf93da37f", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "aa8287f21de70ead", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "e6d2e127ee7fa8a6", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "aecb00f24b1059e9", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "84eacb162de77cf1", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "7853a0c2019758b8", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "40b966c29c2bf004", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "b4a65e6f0e8eefc8", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-b6ad645aba6f9b1c", "level": "error", "message": {"text": "FastAPI POST `run_agent` without auth dependency \u2014 src/api.py:223"}, "properties": {"repobilityId": "065d25ef56f5fc55", "scanner": "scanner-primary", "fingerprint": "b6ad645aba6f9b1c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/api.py"}, "region": {"startLine": 223}}}]}, {"ruleId": "scanner-117b29a0cb7791fc", "level": "error", "message": {"text": "FastAPI POST `cancel_session` without auth dependency \u2014 src/api.py:315"}, "properties": {"repobilityId": "cb56d59e32c1ebde", "scanner": "scanner-primary", "fingerprint": "117b29a0cb7791fc", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/api.py"}, "region": {"startLine": 315}}}]}, {"ruleId": "scanner-7c67eda688d8c800", "level": "error", "message": {"text": "FastAPI POST `generate_storyboard` without auth dependency \u2014 src/demo/router.py:337"}, "properties": {"repobilityId": "a669c68688231df1", "scanner": "scanner-primary", "fingerprint": "7c67eda688d8c800", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/demo/router.py"}, "region": {"startLine": 337}}}]}, {"ruleId": "scanner-5dc8c3b775f70cc5", "level": "error", "message": {"text": "FastAPI POST `route_task` without auth dependency \u2014 src/router/api.py:174"}, "properties": {"repobilityId": "a2d5b2612f00a49b", "scanner": "scanner-primary", "fingerprint": "5dc8c3b775f70cc5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/router/api.py"}, "region": {"startLine": 174}}}]}, {"ruleId": "scanner-45379af1a2b03453", "level": "error", "message": {"text": "FastAPI POST `start_demo_pipeline` without auth dependency \u2014 src/tools/video/demo_pipeline_router.py:220"}, "properties": {"repobilityId": "ad2ccfc25e2d1e16", "scanner": "scanner-primary", "fingerprint": "45379af1a2b03453", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/tools/video/demo_pipeline_router.py"}, "region": {"startLine": 220}}}]}, {"ruleId": "scanner-d8da0e0514a28ae2", "level": "error", "message": {"text": "FastAPI POST `generate_code_storyboard` without auth dependency \u2014 src/storyboard/router.py:338"}, "properties": {"repobilityId": "263ec60c6c53b94e", "scanner": "scanner-primary", "fingerprint": "d8da0e0514a28ae2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/storyboard/router.py"}, "region": {"startLine": 338}}}]}, {"ruleId": "scanner-a0ffa9b6876a5bea", "level": "error", "message": {"text": "FastAPI POST `generate_roadmap_storyboard` without auth dependency \u2014 src/storyboard/router.py:381"}, "properties": {"repobilityId": "7f1f2708148cf1f4", "scanner": "scanner-primary", "fingerprint": "a0ffa9b6876a5bea", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/storyboard/router.py"}, "region": {"startLine": 381}}}]}, {"ruleId": "scanner-c7a5d52f4924b693", "level": "error", "message": {"text": "FastAPI POST `generate_transcript_storyboard` without auth dependency \u2014 src/storyboard/router.py:424"}, "properties": {"repobilityId": "1a50a08df04e51c6", "scanner": "scanner-primary", "fingerprint": "c7a5d52f4924b693", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/storyboard/router.py"}, "region": {"startLine": 424}}}]}, {"ruleId": "scanner-b6c481c5da6f79ce", "level": "error", "message": {"text": "FastAPI POST `generate_meeting_recap` without auth dependency \u2014 src/storyboard/router.py:509"}, "properties": {"repobilityId": "a1daea3d69fdf725", "scanner": "scanner-primary", "fingerprint": "b6c481c5da6f79ce", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/storyboard/router.py"}, "region": {"startLine": 509}}}]}, {"ruleId": "scanner-85da5ad1156cb208", "level": "error", "message": {"text": "FastAPI POST `submit_survey` without auth dependency \u2014 src/storyboard/router.py:696"}, "properties": {"repobilityId": "3e00ec7cbe9e1e27", "scanner": "scanner-primary", "fingerprint": "85da5ad1156cb208", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/storyboard/router.py"}, "region": {"startLine": 696}}}]}, {"ruleId": "scanner-9b01bb989de3c13a", "level": "error", "message": {"text": "FastAPI POST `start_oauth` without auth dependency \u2014 src/routers/connectors.py:602"}, "properties": {"repobilityId": "aef6829581379577", "scanner": "scanner-primary", "fingerprint": "9b01bb989de3c13a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/routers/connectors.py"}, "region": {"startLine": 602}}}]}, {"ruleId": "scanner-30a66a4a4b8c5d8d", "level": "error", "message": {"text": "FastAPI POST `connect_api_key` without auth dependency \u2014 src/routers/connectors.py:743"}, "properties": {"repobilityId": "47760ab3d490e49c", "scanner": "scanner-primary", "fingerprint": "30a66a4a4b8c5d8d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/routers/connectors.py"}, "region": {"startLine": 743}}}]}, {"ruleId": "scanner-04bb971f86037ea5", "level": "error", "message": {"text": "FastAPI POST `trigger_sync` without auth dependency \u2014 src/routers/connectors.py:841"}, "properties": {"repobilityId": "529a08ffd5f11cd0", "scanner": "scanner-primary", "fingerprint": "04bb971f86037ea5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/routers/connectors.py"}, "region": {"startLine": 841}}}]}, {"ruleId": "scanner-2c966e250d9bf844", "level": "error", "message": {"text": "FastAPI DELETE `disconnect` without auth dependency \u2014 src/routers/connectors.py:983"}, "properties": {"repobilityId": "75cf2635b748b688", "scanner": "scanner-primary", "fingerprint": "2c966e250d9bf844", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/routers/connectors.py"}, "region": {"startLine": 983}}}]}, {"ruleId": "scanner-c17e3c05c30da224", "level": "error", "message": {"text": "FastAPI POST `manual_upload` without auth dependency \u2014 src/routers/connectors.py:1033"}, "properties": {"repobilityId": "480dc00a308c8250", "scanner": "scanner-primary", "fingerprint": "c17e3c05c30da224", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/routers/connectors.py"}, "region": {"startLine": 1033}}}]}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "4725bd0cabeb394e", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f7157dfa53a5b604", "level": "note", "message": {"text": "Unused endpoint: POST /agents/run"}, "properties": {"repobilityId": "08948c5c1bf2ffa0", "scanner": "scanner-primary", "fingerprint": "f7157dfa53a5b604", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fb6fad685bfa9ff7", "level": "note", "message": {"text": "Unused endpoint: GET /agents/{session_id}"}, "properties": {"repobilityId": "cb4b31aad0c59eea", "scanner": "scanner-primary", "fingerprint": "fb6fad685bfa9ff7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-65323861d802e87e", "level": "note", "message": {"text": "Unused endpoint: POST /agents/{session_id}/cancel"}, "properties": {"repobilityId": "d7c5207fc26115b1", "scanner": "scanner-primary", "fingerprint": "65323861d802e87e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-582b00fca2796501", "level": "note", "message": {"text": "Unused endpoint: GET /tools"}, "properties": {"repobilityId": "c0263916a4b4a65d", "scanner": "scanner-primary", "fingerprint": "582b00fca2796501", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0bb20633b766f2c8", "level": "note", "message": {"text": "Unused endpoint: GET /options"}, "properties": {"repobilityId": "ad2ffd783c336429", "scanner": "scanner-primary", "fingerprint": "0bb20633b766f2c8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cb92e9ce17198528", "level": "note", "message": {"text": "Unused endpoint: GET /examples"}, "properties": {"repobilityId": "120c2920bb271125", "scanner": "scanner-primary", "fingerprint": "cb92e9ce17198528", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-57d4028fa73def44", "level": "note", "message": {"text": "Unused endpoint: GET /examples/{name}"}, "properties": {"repobilityId": "4237694c752b4707", "scanner": "scanner-primary", "fingerprint": "57d4028fa73def44", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-970eb92d6ec2bfaa", "level": "note", "message": {"text": "Unused endpoint: POST /generate"}, "properties": {"repobilityId": "34217001e2d7d642", "scanner": "scanner-primary", "fingerprint": "970eb92d6ec2bfaa", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-126cf9ba887887cc", "level": "note", "message": {"text": "Unused endpoint: GET /fonts.css"}, "properties": {"repobilityId": "d654f41685b6a002", "scanner": "scanner-primary", "fingerprint": "126cf9ba887887cc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-227c1a502b5e8189", "level": "note", "message": {"text": "Unused endpoint: GET /font/{key}.otf"}, "properties": {"repobilityId": "9194fb8f07e75074", "scanner": "scanner-primary", "fingerprint": "227c1a502b5e8189", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7a009b1a56794f45", "level": "note", "message": {"text": "Unused endpoint: POST /"}, "properties": {"repobilityId": "2f7a85cef16ab7d3", "scanner": "scanner-primary", "fingerprint": "7a009b1a56794f45", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-28e338a59684caeb", "level": "note", "message": {"text": "Unused endpoint: GET /chains"}, "properties": {"repobilityId": "8dc1a16b1b914b4f", "scanner": "scanner-primary", "fingerprint": "28e338a59684caeb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-be673e0aa1be827a", "level": "note", "message": {"text": "Unused endpoint: GET /{job_id}"}, "properties": {"repobilityId": "9510ebd12c561870", "scanner": "scanner-primary", "fingerprint": "be673e0aa1be827a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cef303b904ddfef8", "level": "note", "message": {"text": "Unused endpoint: POST /demo-pipeline"}, "properties": {"repobilityId": "beaa411206b05972", "scanner": "scanner-primary", "fingerprint": "cef303b904ddfef8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e8eb05238798dd33", "level": "note", "message": {"text": "Unused endpoint: GET /demo-pipeline/jobs/{job_id}"}, "properties": {"repobilityId": "c97f52fd65b0a3c0", "scanner": "scanner-primary", "fingerprint": "e8eb05238798dd33", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e9ca4e347c1cab3a", "level": "note", "message": {"text": "Unused endpoint: POST /code"}, "properties": {"repobilityId": "e2af9a74cea95b6e", "scanner": "scanner-primary", "fingerprint": "e9ca4e347c1cab3a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-114278f28f36ace6", "level": "note", "message": {"text": "Unused endpoint: POST /roadmap"}, "properties": {"repobilityId": "4e8c620b2e48e28d", "scanner": "scanner-primary", "fingerprint": "114278f28f36ace6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d170c29d3a4bce09", "level": "note", "message": {"text": "Unused endpoint: POST /transcript"}, "properties": {"repobilityId": "dad437fa1a95e0bd", "scanner": "scanner-primary", "fingerprint": "d170c29d3a4bce09", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ee53a8b03729481e", "level": "note", "message": {"text": "Unused endpoint: GET /jobs/{job_id}"}, "properties": {"repobilityId": "87576f4c05064f55", "scanner": "scanner-primary", "fingerprint": "ee53a8b03729481e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5231dc73c9d28c11", "level": "note", "message": {"text": "Unused endpoint: POST /meeting-recap"}, "properties": {"repobilityId": "c799d43e62448d83", "scanner": "scanner-primary", "fingerprint": "5231dc73c9d28c11", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-71fdfae11fc560ed", "level": "note", "message": {"text": "Unused endpoint: GET /survey/templates/{vertical}"}, "properties": {"repobilityId": "37538d9cee1b8d79", "scanner": "scanner-primary", "fingerprint": "71fdfae11fc560ed", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-85eeccd2ba9bad7a", "level": "note", "message": {"text": "Unused endpoint: POST /survey/submit"}, "properties": {"repobilityId": "fec7ba861bc3bf15", "scanner": "scanner-primary", "fingerprint": "85eeccd2ba9bad7a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-09db04339472cc4e", "level": "note", "message": {"text": "Unused endpoint: GET /instances"}, "properties": {"repobilityId": "de0d7b343851949a", "scanner": "scanner-primary", "fingerprint": "09db04339472cc4e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fd313f34383e32b5", "level": "note", "message": {"text": "Unused endpoint: GET /instances/{instance_id}"}, "properties": {"repobilityId": "0166ba526aa98e5a", "scanner": "scanner-primary", "fingerprint": "fd313f34383e32b5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-935e92ed7330d84c", "level": "note", "message": {"text": "Unused endpoint: POST /{connector_type}/oauth/authorize"}, "properties": {"repobilityId": "c6f0d14519f9eb32", "scanner": "scanner-primary", "fingerprint": "935e92ed7330d84c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3f945bfe87d63c9a", "level": "note", "message": {"text": "Unused endpoint: POST /{connector_type}/oauth/callback"}, "properties": {"repobilityId": "0e3477900c1a472c", "scanner": "scanner-primary", "fingerprint": "3f945bfe87d63c9a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-07173efac5fdc1c1", "level": "note", "message": {"text": "Unused endpoint: POST /{connector_type}/connect"}, "properties": {"repobilityId": "0492ec4a307c0607", "scanner": "scanner-primary", "fingerprint": "07173efac5fdc1c1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3fffc6def5524181", "level": "note", "message": {"text": "Unused endpoint: POST /instances/{instance_id}/sync"}, "properties": {"repobilityId": "f2cb5532d46ac71b", "scanner": "scanner-primary", "fingerprint": "3fffc6def5524181", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3dcb7fdd20190ddb", "level": "note", "message": {"text": "Unused endpoint: GET /instances/{instance_id}/sync-history"}, "properties": {"repobilityId": "eac5a04199d220c3", "scanner": "scanner-primary", "fingerprint": "3dcb7fdd20190ddb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f054b1a90878f66c", "level": "note", "message": {"text": "Unused endpoint: DELETE /instances/{instance_id}"}, "properties": {"repobilityId": "598f20d20251bcb8", "scanner": "scanner-primary", "fingerprint": "f054b1a90878f66c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9ceb38ccbe61dc41", "level": "note", "message": {"text": "Unused endpoint: POST /instances/{instance_id}/upload"}, "properties": {"repobilityId": "ddf43f82c4ef480f", "scanner": "scanner-primary", "fingerprint": "9ceb38ccbe61dc41", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}