{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-1ebad8e529816aa4", "name": "Possibly dead Python function: put_session", "shortDescription": {"text": "Possibly dead Python function: put_session"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cd86543d50b85408", "name": "Possibly dead Python function: put_event", "shortDescription": {"text": "Possibly dead Python function: put_event"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7abd08e05fea0869", "name": "Possibly dead Python function: put_user", "shortDescription": {"text": "Possibly dead Python function: put_user"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d2364c022438b693", "name": "Possibly dead Python function: put_audit", "shortDescription": {"text": "Possibly dead Python function: put_audit"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-45277d53a0fa6d68", "name": "Possibly dead Python function: require_mgmt_user", "shortDescription": {"text": "Possibly dead Python function: require_mgmt_user"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2b65e82b59df8ca6", "name": "Possibly dead Python function: require_admin", "shortDescription": {"text": "Possibly dead Python function: require_admin"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b5d8836d69a503cf", "name": "Stray `console.log` in TS/JS \u2014 desktop/test/protocol.test.js:77", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 desktop/test/protocol.test.js:77"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-afd7cfbe0a3bf2f2", "name": "Stray `console.log` in TS/JS \u2014 desktop/test/smoke.js:25", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 desktop/test/smoke.js:25"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d03c6d173013e631", "name": "Stray `console.log` in TS/JS \u2014 desktop/scripts/build-main.js:45", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 desktop/scripts/build-main.js:45"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9bc800ee06362402", "name": "Stray `console.log` in TS/JS \u2014 desktop/scripts/copy-renderer.js:22", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 desktop/scripts/copy-renderer.js:22"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-31d4dbf2ed823c6a", "name": "Insecure pattern 'local_storage_auth_token' in ui/src/api.test.js:556", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in ui/src/api.test.js:556"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8f47c96d5444255f", "name": "Insecure pattern 'local_storage_auth_token' in ui/src/app/Login.jsx:45", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in ui/src/app/Login.jsx:45"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-241f490b56d280d0", "name": "Insecure pattern 'local_storage_auth_token' in src/channel/auth/mgmt_auth.py:95", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in src/channel/auth/mgmt_auth.py:95"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fe82dc4c5a28d6b9", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-64192a3c67110d01", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-420770c48b8d4613", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1032c25dd065edaf", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-84012fa5b95d5abb", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-764ba5861766b51b", "name": "Very large file: tests/unit/test_storage.py (1752 lines)", "shortDescription": {"text": "Very large file: tests/unit/test_storage.py (1752 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cbf5acf526487db8", "name": "Very large file: tests/unit/test_chats_api.py (3745 lines)", "shortDescription": {"text": "Very large file: tests/unit/test_chats_api.py (3745 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4f308fa03717e23a", "name": "Very large file: ui/src/app/Conversation.test.jsx (1616 lines)", "shortDescription": {"text": "Very large file: ui/src/app/Conversation.test.jsx (1616 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6481142552a77eac", "name": "Very large file: infra/stacks/channel_stack.py (1919 lines)", "shortDescription": {"text": "Very large file: infra/stacks/channel_stack.py (1919 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 69 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 39 placeholder/mock markers across 17 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9d79c4077342a7d0", "name": "Runtime service client appears to use placeholder configuration", "shortDescription": {"text": "Runtime service client appears to use placeholder configuration"}, "fullDescription": {"text": "A runtime source file appears to wire Supabase/Firebase/AI/payment-style clients to placeholder URLs, keys, or fallback values. In the Fable corpus this often means the UI/API shape is present while the backend service is not actually configured."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8175b33933e94adc", "name": "Agent instruction/config may expose a secret: .claude/agents/onboarding.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/agents/onboarding.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-64e53a9f4448a840", "name": "Agent authority lacks a verifier contract: .claude/agents/design-review.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agents/design-review.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-151b65fb4642ab6b", "name": "Agent instruction/config may expose a secret: .claude/agents/incident-responder.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/agents/incident-responder.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-811b9c16cadc4d67", "name": "Agent authority lacks a verifier contract: .claude/agents/incident-responder.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agents/incident-responder.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a49e6063eaba5286", "name": "Agent instruction/config may expose a secret: .claude/skills/fastapi-route/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/skills/fastapi-route/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7acd8f13a00f0a98", "name": "Commented-code block (9 lines) in tasks.py:510", "shortDescription": {"text": "Commented-code block (9 lines) in tasks.py:510"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0b3036dd226aa4bb", "name": "Network/subprocess call without timeout or try/except \u2014 tasks.py:600", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 tasks.py:600"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-74fd9521ab0e4ef2", "name": "Commented-code block (5 lines) in tests/integration/conftest.py:20", "shortDescription": {"text": "Commented-code block (5 lines) in tests/integration/conftest.py:20"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-97479b4123618a56", "name": "Commented-code block (5 lines) in tests/unit/test_storage.py:141", "shortDescription": {"text": "Commented-code block (5 lines) in tests/unit/test_storage.py:141"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9b3ffca846da1827", "name": "Legacy-named symbol `_extract_legacy` in tests/unit/test_csp.py:8", "shortDescription": {"text": "Legacy-named symbol `_extract_legacy` in tests/unit/test_csp.py:8"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-82c310e2021c161f", "name": "Commented-code block (5 lines) in tests/unit/test_mcp_auth.py:535", "shortDescription": {"text": "Commented-code block (5 lines) in tests/unit/test_mcp_auth.py:535"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d44e0ddc952d5772", "name": "Commented-code block (8 lines) in tests/unit/test_chat_agent.py:561", "shortDescription": {"text": "Commented-code block (8 lines) in tests/unit/test_chat_agent.py:561"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4054b6240d265c59", "name": "Commented-code block (11 lines) in tests/unit/test_tools_web_search.py:32", "shortDescription": {"text": "Commented-code block (11 lines) in tests/unit/test_tools_web_search.py:32"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f4e54afe46ce1bf1", "name": "Commented-code block (6 lines) in tests/unit/test_chats_api.py:539", "shortDescription": {"text": "Commented-code block (6 lines) in tests/unit/test_chats_api.py:539"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b15fe8c7e5948290", "name": "Commented-code block (7 lines) in tests/unit/test_tools_web_fetch.py:233", "shortDescription": {"text": "Commented-code block (7 lines) in tests/unit/test_tools_web_fetch.py:233"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d6883de8c4ed2676", "name": "Commented-code block (5 lines) in tests/unit/test_tool_hooks.py:467", "shortDescription": {"text": "Commented-code block (5 lines) in tests/unit/test_tool_hooks.py:467"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f0f8540ed998d8d2", "name": "Commented-code block (5 lines) in tests/unit/test_check_agent_safe_scope.py:585", "shortDescription": {"text": "Commented-code block (5 lines) in tests/unit/test_check_agent_safe_scope.py:585"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d6150b1f039d89df", "name": "Commented-code block (13 lines) in tests/unit/test_strands_sse.py:243", "shortDescription": {"text": "Commented-code block (13 lines) in tests/unit/test_strands_sse.py:243"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-07907a3850b17448", "name": "Commented-code block (13 lines) in tests/e2e/test_memory_recall_and_titling.py:98", "shortDescription": {"text": "Commented-code block (13 lines) in tests/e2e/test_memory_recall_and_titling.py:98"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2a47f511933917d8", "name": "Commented-code block (7 lines) in tests/e2e/test_attachments.py:308", "shortDescription": {"text": "Commented-code block (7 lines) in tests/e2e/test_attachments.py:308"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ea1dfbce4cee5a31", "name": "Commented-code block (6 lines) in tests/e2e/test_tool_use_smoke.py:111", "shortDescription": {"text": "Commented-code block (6 lines) in tests/e2e/test_tool_use_smoke.py:111"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d9eac484b36f138c", "name": "Commented-code block (5 lines) in ui/src/api.js:20", "shortDescription": {"text": "Commented-code block (5 lines) in ui/src/api.js:20"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4b758dfbe956ba87", "name": "`fetch()` without try/.catch or AbortSignal \u2014 ui/src/api.js:27", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 ui/src/api.js:27"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8ef797eadc96f5d6", "name": "Commented-code block (6 lines) in ui/src/setupTests.js:14", "shortDescription": {"text": "Commented-code block (6 lines) in ui/src/setupTests.js:14"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d90d2bdae85f4fa4", "name": "Commented-code block (7 lines) in ui/src/components/ErrorBoundary.test.jsx:95", "shortDescription": {"text": "Commented-code block (7 lines) in ui/src/components/ErrorBoundary.test.jsx:95"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fda841b44f8ab14f", "name": "Commented-code block (5 lines) in ui/src/app/Conversation.jsx:21", "shortDescription": {"text": "Commented-code block (5 lines) in ui/src/app/Conversation.jsx:21"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fbf108c76b5141d5", "name": "Commented-code block (5 lines) in ui/src/app/Conversation.test.jsx:689", "shortDescription": {"text": "Commented-code block (5 lines) in ui/src/app/Conversation.test.jsx:689"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-001047312f4c3147", "name": "Commented-code block (8 lines) in ui/src/app/Sidebar.jsx:74", "shortDescription": {"text": "Commented-code block (8 lines) in ui/src/app/Sidebar.jsx:74"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3c37baaf08eebbff", "name": "Commented-code block (5 lines) in ui/src/app/Shell.test.jsx:72", "shortDescription": {"text": "Commented-code block (5 lines) in ui/src/app/Shell.test.jsx:72"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f9434973b6687bc7", "name": "Commented-code block (5 lines) in ui/src/app/MCPPicker.jsx:61", "shortDescription": {"text": "Commented-code block (5 lines) in ui/src/app/MCPPicker.jsx:61"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-71d6f68557cfcfb7", "name": "Commented-code block (7 lines) in ui/src/app/data.js:21", "shortDescription": {"text": "Commented-code block (7 lines) in ui/src/app/data.js:21"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-aebc37b586994b35", "name": "Commented-code block (7 lines) in ui/src/app/ToolResultBlock.test.jsx:123", "shortDescription": {"text": "Commented-code block (7 lines) in ui/src/app/ToolResultBlock.test.jsx:123"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-785e8d19da530105", "name": "Commented-code block (6 lines) in ui/src/app/Composer.jsx:285", "shortDescription": {"text": "Commented-code block (6 lines) in ui/src/app/Composer.jsx:285"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-87642fe0e72ff829", "name": "Commented-code block (5 lines) in ui/src/app/ToolResultBlock.jsx:3", "shortDescription": {"text": "Commented-code block (5 lines) in ui/src/app/ToolResultBlock.jsx:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ab92a16b9851ef46", "name": "Commented-code block (5 lines) in ui/src/app/views/Customize.jsx:26", "shortDescription": {"text": "Commented-code block (5 lines) in ui/src/app/views/Customize.jsx:26"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ff41168bb1bca226", "name": "Commented-code block (6 lines) in ui/src/marketing/pages/Download.test.jsx:43", "shortDescription": {"text": "Commented-code block (6 lines) in ui/src/marketing/pages/Download.test.jsx:43"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2cbdf834aafeeda3", "name": "Commented-code block (6 lines) in ui/src/hooks/useChatStream.js:6", "shortDescription": {"text": "Commented-code block (6 lines) in ui/src/hooks/useChatStream.js:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7dc57a5bb240a4a0", "name": "Commented-code block (5 lines) in ui/src/hooks/useChannelPrefs.js:71", "shortDescription": {"text": "Commented-code block (5 lines) in ui/src/hooks/useChannelPrefs.js:71"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d0d37cb37747299c", "name": "Commented-code block (8 lines) in ui/src/hooks/useChatStream.test.js:530", "shortDescription": {"text": "Commented-code block (8 lines) in ui/src/hooks/useChatStream.test.js:530"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4d49e0290ee32728", "name": "Commented-code block (7 lines) in scripts/check_branch_protection_drift.py:154", "shortDescription": {"text": "Commented-code block (7 lines) in scripts/check_branch_protection_drift.py:154"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-332e57b41c731d54", "name": "Commented-code block (7 lines) in scripts/check_agent_safe_scope.py:237", "shortDescription": {"text": "Commented-code block (7 lines) in scripts/check_agent_safe_scope.py:237"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9b4b6b8ccf17eeaa", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/check_agent_safe_scope.py:580", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/check_agent_safe_scope.py:580"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-78ed918cfaec30cb", "name": "Commented-code block (5 lines) in desktop/test/protocol.test.js:92", "shortDescription": {"text": "Commented-code block (5 lines) in desktop/test/protocol.test.js:92"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a8259ec8f84905c3", "name": "Commented-code block (5 lines) in desktop/test/smoke.js:11", "shortDescription": {"text": "Commented-code block (5 lines) in desktop/test/smoke.js:11"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-13fc9ca13e46a9de", "name": "Network/subprocess call without timeout or try/except \u2014 desktop/scripts/generate_icon.py:149", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 desktop/scripts/generate_icon.py:149"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6bbd46537d614a3f", "name": "Commented-code block (6 lines) in desktop/main/window.js:4", "shortDescription": {"text": "Commented-code block (6 lines) in desktop/main/window.js:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-aee8103ff0ad6cc3", "name": "Commented-code block (5 lines) in desktop/main/updater.js:30", "shortDescription": {"text": "Commented-code block (5 lines) in desktop/main/updater.js:30"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3ba4ac7b96032a23", "name": "Commented-code block (6 lines) in desktop/main/index.js:37", "shortDescription": {"text": "Commented-code block (6 lines) in desktop/main/index.js:37"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e8c61011358b8c6e", "name": "Commented-code block (7 lines) in .claude/skills/dynamodb-item/example.py:38", "shortDescription": {"text": "Commented-code block (7 lines) in .claude/skills/dynamodb-item/example.py:38"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fca5d32fd4e48585", "name": "Commented-code block (5 lines) in .claude/skills/react-component/example.jsx:5", "shortDescription": {"text": "Commented-code block (5 lines) in .claude/skills/react-component/example.jsx:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2c73b5c40647d220", "name": "Legacy-named symbol `bucket_legacy` in infra/stacks/channel_stack.py:73", "shortDescription": {"text": "Legacy-named symbol `bucket_legacy` in infra/stacks/channel_stack.py:73"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c680a53be4d38d32", "name": "Commented-code block (8 lines) in infra/stacks/channel_stack.py:222", "shortDescription": {"text": "Commented-code block (8 lines) in infra/stacks/channel_stack.py:222"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3176c19b9cce3419", "name": "Commented-code block (6 lines) in src/channel/storage.py:651", "shortDescription": {"text": "Commented-code block (6 lines) in src/channel/storage.py:651"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2bec083652560a7f", "name": "Commented-code block (7 lines) in src/channel/models.py:91", "shortDescription": {"text": "Commented-code block (7 lines) in src/channel/models.py:91"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f7003455b6856e8f", "name": "Commented-code block (8 lines) in src/channel/auth/mgmt_auth.py:146", "shortDescription": {"text": "Commented-code block (8 lines) in src/channel/auth/mgmt_auth.py:146"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f0d59826d2dd5dfb", "name": "Commented-code block (8 lines) in src/channel/auth/state_store.py:142", "shortDescription": {"text": "Commented-code block (8 lines) in src/channel/auth/state_store.py:142"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c8be82e9b0874e4f", "name": "Commented-code block (7 lines) in src/channel/auth/logout.py:80", "shortDescription": {"text": "Commented-code block (7 lines) in src/channel/auth/logout.py:80"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-25392aed4264af22", "name": "Commented-code block (5 lines) in src/channel/api/mcp.py:61", "shortDescription": {"text": "Commented-code block (5 lines) in src/channel/api/mcp.py:61"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8c815fcf2425bac3", "name": "Legacy-named symbol `_extract_legacy` in src/channel/api/csp.py:35", "shortDescription": {"text": "Legacy-named symbol `_extract_legacy` in src/channel/api/csp.py:35"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f9a901fca60c2269", "name": "Commented-code block (8 lines) in src/channel/api/chats.py:131", "shortDescription": {"text": "Commented-code block (8 lines) in src/channel/api/chats.py:131"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-95160b6ed695b943", "name": "Commented-code block (6 lines) in src/channel/api/_auth.py:37", "shortDescription": {"text": "Commented-code block (6 lines) in src/channel/api/_auth.py:37"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e72ed35b1c47d819", "name": "Commented-code block (5 lines) in src/channel/api/main.py:40", "shortDescription": {"text": "Commented-code block (5 lines) in src/channel/api/main.py:40"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2ea0765b40625826", "name": "Commented-code block (5 lines) in src/channel/api/attachments.py:215", "shortDescription": {"text": "Commented-code block (5 lines) in src/channel/api/attachments.py:215"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9b2a381172d4064d", "name": "Commented-code block (6 lines) in src/channel/mcp/transports.py:44", "shortDescription": {"text": "Commented-code block (6 lines) in src/channel/mcp/transports.py:44"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c17cf1eac1480cd8", "name": "Commented-code block (8 lines) in src/channel/sandbox/handler.py:280", "shortDescription": {"text": "Commented-code block (8 lines) in src/channel/sandbox/handler.py:280"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d8cc4ba254651316", "name": "Commented-code block (9 lines) in src/channel/agents/tool_hooks.py:78", "shortDescription": {"text": "Commented-code block (9 lines) in src/channel/agents/tool_hooks.py:78"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c170c666ac57ded4", "name": "Commented-code block (10 lines) in src/channel/agents/recall.py:208", "shortDescription": {"text": "Commented-code block (10 lines) in src/channel/agents/recall.py:208"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1ff9433e8aca906e", "name": "Commented-code block (8 lines) in src/channel/agents/chat_agent.py:35", "shortDescription": {"text": "Commented-code block (8 lines) in src/channel/agents/chat_agent.py:35"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3345667749461aa9", "name": "Commented-code block (6 lines) in src/channel/agents/memory.py:34", "shortDescription": {"text": "Commented-code block (6 lines) in src/channel/agents/memory.py:34"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6906d1ab43e3d204", "name": "Commented-code block (6 lines) in src/channel/agents/strands_sse.py:18", "shortDescription": {"text": "Commented-code block (6 lines) in src/channel/agents/strands_sse.py:18"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-471b8140ce972062", "name": "Commented-code block (6 lines) in src/channel/agents/tools/web_search.py:48", "shortDescription": {"text": "Commented-code block (6 lines) in src/channel/agents/tools/web_search.py:48"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-feb4c2164e063fcd", "name": "Commented-code block (6 lines) in src/channel/agents/tools/code_exec.py:116", "shortDescription": {"text": "Commented-code block (6 lines) in src/channel/agents/tools/code_exec.py:116"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cce556a852eea36b", "name": "Commented-code block (5 lines) in src/channel/agents/tools/web_fetch.py:59", "shortDescription": {"text": "Commented-code block (5 lines) in src/channel/agents/tools/web_fetch.py:59"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\ntasks.py:lint_backend, tasks.py:lint\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nsrc/channel/agents/tool_hooks.py:register_hooks, src/channel/agents/tool_hooks.py:register_hooks, src/channel/agents/tool_hooks.py:register_hooks\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b9f1b79c317bdc63", "name": "Frontend route `/app/c/:id` has no Link/navigate to it \u2014 ui/src/app/views/ProjectDetail.test.jsx", "shortDescription": {"text": "Frontend route `/app/c/:id` has no Link/navigate to it \u2014 ui/src/app/views/ProjectDetail.test.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bd44498e50e03862", "name": "Frontend route `/app/projects/:id` has no Link/navigate to it \u2014 ui/src/app/views/Projects.test.jsx", "shortDescription": {"text": "Frontend route `/app/projects/:id` has no Link/navigate to it \u2014 ui/src/app/views/Projects.test.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-72daaa97e6a28ee0", "name": "Frontend route `/app/c/:id?` has no Link/navigate to it \u2014 ui/src/app/Conversation.test.jsx", "shortDescription": {"text": "Frontend route `/app/c/:id?` has no Link/navigate to it \u2014 ui/src/app/Conversation.test.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8743c7cdcee750f2", "name": "Frontend route `/app/*` has no Link/navigate to it \u2014 ui/src/app/ChatHeader.test.jsx", "shortDescription": {"text": "Frontend route `/app/*` has no Link/navigate to it \u2014 ui/src/app/ChatHeader.test.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dda551a44533d855", "name": "FastAPI POST `receive_csp_report` without auth dependency \u2014 src/channel/api/csp.py:95", "shortDescription": {"text": "FastAPI POST `receive_csp_report` without auth dependency \u2014 src/channel/api/csp.py:95"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f43d2071795b9dfa", "name": "Unused endpoint: POST /widgets", "shortDescription": {"text": "Unused endpoint: POST /widgets"}, "fullDescription": {"text": "`.claude/skills/fastapi-route/example.py` declares `POST /widgets` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-18f088c4b5c6ece4", "name": "Unused endpoint: POST /widgets/stream", "shortDescription": {"text": "Unused endpoint: POST /widgets/stream"}, "fullDescription": {"text": "`.claude/skills/fastapi-route/example.py` declares `POST /widgets/stream` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-76fe223a158845f6", "name": "Unused endpoint: GET /auth/login", "shortDescription": {"text": "Unused endpoint: GET /auth/login"}, "fullDescription": {"text": "`src/channel/auth/mgmt_auth.py` declares `GET /auth/login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1480187b44a5fd90", "name": "Unused endpoint: GET /auth/callback", "shortDescription": {"text": "Unused endpoint: GET /auth/callback"}, "fullDescription": {"text": "`src/channel/auth/mgmt_auth.py` declares `GET /auth/callback` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c059f57186114027", "name": "Unused endpoint: POST /auth/logout", "shortDescription": {"text": "Unused endpoint: POST /auth/logout"}, "fullDescription": {"text": "`src/channel/auth/logout.py` declares `POST /auth/logout` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e9ecd5ae1040af7e", "name": "Unused endpoint: GET /api/mcp/servers", "shortDescription": {"text": "Unused endpoint: GET /api/mcp/servers"}, "fullDescription": {"text": "`src/channel/api/mcp.py` declares `GET /api/mcp/servers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3163641cea3a5b6a", "name": "Unused endpoint: POST /api/mcp/servers", "shortDescription": {"text": "Unused endpoint: POST /api/mcp/servers"}, "fullDescription": {"text": "`src/channel/api/mcp.py` declares `POST /api/mcp/servers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eb6c7ec2212f1cf3", "name": "Unused endpoint: GET /auth/mcp/callback", "shortDescription": {"text": "Unused endpoint: GET /auth/mcp/callback"}, "fullDescription": {"text": "`src/channel/api/mcp.py` declares `GET /auth/mcp/callback` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a53cd65b8ab5d353", "name": "Unused endpoint: PATCH /api/mcp/servers/{server_id}", "shortDescription": {"text": "Unused endpoint: PATCH /api/mcp/servers/{server_id}"}, "fullDescription": {"text": "`src/channel/api/mcp.py` declares `PATCH /api/mcp/servers/{server_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ba2e286cd2255a8b", "name": "Unused endpoint: DELETE /api/mcp/servers/{server_id}", "shortDescription": {"text": "Unused endpoint: DELETE /api/mcp/servers/{server_id}"}, "fullDescription": {"text": "`src/channel/api/mcp.py` declares `DELETE /api/mcp/servers/{server_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5eea6ec523138e72", "name": "Unused endpoint: POST /api/mcp/servers/{server_id}/reauth", "shortDescription": {"text": "Unused endpoint: POST /api/mcp/servers/{server_id}/reauth"}, "fullDescription": {"text": "`src/channel/api/mcp.py` declares `POST /api/mcp/servers/{server_id}/reauth` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-005ae9c858e09556", "name": "Unused endpoint: GET /api/chats/{chat_id}/mcp", "shortDescription": {"text": "Unused endpoint: GET /api/chats/{chat_id}/mcp"}, "fullDescription": {"text": "`src/channel/api/mcp.py` declares `GET /api/chats/{chat_id}/mcp` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-93e53bb87b44886e", "name": "Unused endpoint: PUT /api/chats/{chat_id}/mcp", "shortDescription": {"text": "Unused endpoint: PUT /api/chats/{chat_id}/mcp"}, "fullDescription": {"text": "`src/channel/api/mcp.py` declares `PUT /api/chats/{chat_id}/mcp` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f6e1ffc380b91ae1", "name": "Unused endpoint: POST /csp-report", "shortDescription": {"text": "Unused endpoint: POST /csp-report"}, "fullDescription": {"text": "`src/channel/api/csp.py` declares `POST /csp-report` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-80a8dac1d2e5a55e", "name": "Unused endpoint: GET /api/me/prefs", "shortDescription": {"text": "Unused endpoint: GET /api/me/prefs"}, "fullDescription": {"text": "`src/channel/api/prefs.py` declares `GET /api/me/prefs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f4b64137568b745d", "name": "Unused endpoint: PUT /api/me/prefs", "shortDescription": {"text": "Unused endpoint: PUT /api/me/prefs"}, "fullDescription": {"text": "`src/channel/api/prefs.py` declares `PUT /api/me/prefs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8b80a7b7877ecc38", "name": "Unused endpoint: GET /memory/events", "shortDescription": {"text": "Unused endpoint: GET /memory/events"}, "fullDescription": {"text": "`src/channel/api/_debug.py` declares `GET /memory/events` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e15d5c2bceef4423", "name": "Unused endpoint: DELETE /memory/events", "shortDescription": {"text": "Unused endpoint: DELETE /memory/events"}, "fullDescription": {"text": "`src/channel/api/_debug.py` declares `DELETE /memory/events` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a009b1a56794f45", "name": "Unused endpoint: POST /", "shortDescription": {"text": "Unused endpoint: POST /"}, "fullDescription": {"text": "`src/channel/api/chats.py` declares `POST /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`src/channel/api/chats.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ac5c6ba288e40fb1", "name": "Unused endpoint: GET /{chat_id}", "shortDescription": {"text": "Unused endpoint: GET /{chat_id}"}, "fullDescription": {"text": "`src/channel/api/chats.py` declares `GET /{chat_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e43e51e7c596b026", "name": "Unused endpoint: PATCH /{chat_id}", "shortDescription": {"text": "Unused endpoint: PATCH /{chat_id}"}, "fullDescription": {"text": "`src/channel/api/chats.py` declares `PATCH /{chat_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-193885acf8185891", "name": "Unused endpoint: DELETE /{chat_id}", "shortDescription": {"text": "Unused endpoint: DELETE /{chat_id}"}, "fullDescription": {"text": "`src/channel/api/chats.py` declares `DELETE /{chat_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-71eb7e7ba4d3fc96", "name": "Unused endpoint: POST /{chat_id}/messages", "shortDescription": {"text": "Unused endpoint: POST /{chat_id}/messages"}, "fullDescription": {"text": "`src/channel/api/chats.py` declares `POST /{chat_id}/messages` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b6b50693aeef5afd", "name": "Unused endpoint: POST /{chat_id}/regenerate", "shortDescription": {"text": "Unused endpoint: POST /{chat_id}/regenerate"}, "fullDescription": {"text": "`src/channel/api/chats.py` declares `POST /{chat_id}/regenerate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3700a5f47e4287c8", "name": "Unused endpoint: POST /{chat_id}/messages/{msg_id}/feedback", "shortDescription": {"text": "Unused endpoint: POST /{chat_id}/messages/{msg_id}/feedback"}, "fullDescription": {"text": "`src/channel/api/chats.py` declares `POST /{chat_id}/messages/{msg_id}/feedback` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2ab9bf5db6820af4", "name": "Unused endpoint: GET /models", "shortDescription": {"text": "Unused endpoint: GET /models"}, "fullDescription": {"text": "`src/channel/api/models.py` declares `GET /models` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-23df988e26cdbbc9", "name": "Unused endpoint: POST /presign", "shortDescription": {"text": "Unused endpoint: POST /presign"}, "fullDescription": {"text": "`src/channel/api/attachments.py` declares `POST /presign` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/22542"}, "properties": {"repository": "warlordofmars/channel", "repoUrl": "https://github.com/warlordofmars/channel", "branch": "main"}, "results": [{"ruleId": "scanner-1ebad8e529816aa4", "level": "note", "message": {"text": "Possibly dead Python function: put_session"}, "properties": {"repobilityId": "addee135a7f885ee", "scanner": "scanner-primary", "fingerprint": "1ebad8e529816aa4", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/dynamodb-item/example.py:67"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cd86543d50b85408", "level": "note", "message": {"text": "Possibly dead Python function: put_event"}, "properties": {"repobilityId": "20d42c834189b1a5", "scanner": "scanner-primary", "fingerprint": "cd86543d50b85408", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/dynamodb-item/example.py:92"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7abd08e05fea0869", "level": "note", "message": {"text": "Possibly dead Python function: put_user"}, "properties": {"repobilityId": "c0cb0f7ac0875a72", "scanner": "scanner-primary", "fingerprint": "7abd08e05fea0869", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/dynamodb-item/example.py:116"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d2364c022438b693", "level": "note", "message": {"text": "Possibly dead Python function: put_audit"}, "properties": {"repobilityId": "579bd69e5d51a0cb", "scanner": "scanner-primary", "fingerprint": "d2364c022438b693", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/dynamodb-item/example.py:152"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-45277d53a0fa6d68", "level": "note", "message": {"text": "Possibly dead Python function: require_mgmt_user"}, "properties": {"repobilityId": "a030b928a63395f1", "scanner": "scanner-primary", "fingerprint": "45277d53a0fa6d68", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/channel/api/_auth.py:17"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2b65e82b59df8ca6", "level": "note", "message": {"text": "Possibly dead Python function: require_admin"}, "properties": {"repobilityId": "3c06db2e25566bf7", "scanner": "scanner-primary", "fingerprint": "2b65e82b59df8ca6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/channel/api/_auth.py:47"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b5d8836d69a503cf", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 desktop/test/protocol.test.js:77"}, "properties": {"repobilityId": "f50d2d7e8728ca5b", "scanner": "scanner-primary", "fingerprint": "b5d8836d69a503cf", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-afd7cfbe0a3bf2f2", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 desktop/test/smoke.js:25"}, "properties": {"repobilityId": "9a1146866edf7a9d", "scanner": "scanner-primary", "fingerprint": "afd7cfbe0a3bf2f2", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-d03c6d173013e631", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 desktop/scripts/build-main.js:45"}, "properties": {"repobilityId": "55ff30d8ceb65f6e", "scanner": "scanner-primary", "fingerprint": "d03c6d173013e631", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9bc800ee06362402", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 desktop/scripts/copy-renderer.js:22"}, "properties": {"repobilityId": "6652dcdb84ee8d9f", "scanner": "scanner-primary", "fingerprint": "9bc800ee06362402", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-31d4dbf2ed823c6a", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in ui/src/api.test.js:556"}, "properties": {"repobilityId": "b633e344c16be81a", "scanner": "scanner-primary", "fingerprint": "31d4dbf2ed823c6a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/src/api.test.js"}, "region": {"startLine": 556}}}]}, {"ruleId": "scanner-8f47c96d5444255f", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in ui/src/app/Login.jsx:45"}, "properties": {"repobilityId": "40ce5412bc5fb181", "scanner": "scanner-primary", "fingerprint": "8f47c96d5444255f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui/src/app/Login.jsx"}, "region": {"startLine": 45}}}]}, {"ruleId": "scanner-241f490b56d280d0", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in src/channel/auth/mgmt_auth.py:95"}, "properties": {"repobilityId": "5fd785d214ac197e", "scanner": "scanner-primary", "fingerprint": "241f490b56d280d0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/channel/auth/mgmt_auth.py"}, "region": {"startLine": 95}}}]}, {"ruleId": "scanner-fe82dc4c5a28d6b9", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "070ce4f7a42e0586", "scanner": "scanner-primary", "fingerprint": "fe82dc4c5a28d6b9", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/dependabot-automerge.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-64192a3c67110d01", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "87338a8bfcb6f435", "scanner": "scanner-primary", "fingerprint": "64192a3c67110d01", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-420770c48b8d4613", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "a9e3f39ec43b203d", "scanner": "scanner-primary", "fingerprint": "420770c48b8d4613", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release-drafter.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1032c25dd065edaf", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "fb3826fcba6e6f64", "scanner": "scanner-primary", "fingerprint": "1032c25dd065edaf", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/backup-test.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-84012fa5b95d5abb", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "dd2bee753ea8fb9c", "scanner": "scanner-primary", "fingerprint": "84012fa5b95d5abb", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-dev.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-764ba5861766b51b", "level": "note", "message": {"text": "Very large file: tests/unit/test_storage.py (1752 lines)"}, "properties": {"repobilityId": "7177117af31e93ac", "scanner": "scanner-primary", "fingerprint": "764ba5861766b51b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-cbf5acf526487db8", "level": "note", "message": {"text": "Very large file: tests/unit/test_chats_api.py (3745 lines)"}, "properties": {"repobilityId": "198b6ba40b26593e", "scanner": "scanner-primary", "fingerprint": "cbf5acf526487db8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-4f308fa03717e23a", "level": "note", "message": {"text": "Very large file: ui/src/app/Conversation.test.jsx (1616 lines)"}, "properties": {"repobilityId": "e80409d40f84b5b0", "scanner": "scanner-primary", "fingerprint": "4f308fa03717e23a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6481142552a77eac", "level": "note", "message": {"text": "Very large file: infra/stacks/channel_stack.py (1919 lines)"}, "properties": {"repobilityId": "85760ceb4b2eaa85", "scanner": "scanner-primary", "fingerprint": "6481142552a77eac", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "5257e39a7adb462e", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "bb897a1a2753947b", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "4facb53ff1f25389", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-9d79c4077342a7d0", "level": "warning", "message": {"text": "Runtime service client appears to use placeholder configuration"}, "properties": {"repobilityId": "6c9fd328b51022b6", "scanner": "scanner-primary", "fingerprint": "9d79c4077342a7d0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "runtime-config", "service-client", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "bfc6b7190f513572", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "964bcce79b41dc24", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "96ab3040d8fa545d", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "5ebdb56f38495d20", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8175b33933e94adc", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/agents/onboarding.md"}, "properties": {"repobilityId": "70a8d3cb1ec35ef2", "scanner": "scanner-primary", "fingerprint": "8175b33933e94adc", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/onboarding.md"}, "region": {"startLine": 143}}}]}, {"ruleId": "scanner-64e53a9f4448a840", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agents/design-review.md"}, "properties": {"repobilityId": "df60bec441ecd499", "scanner": "scanner-primary", "fingerprint": "64e53a9f4448a840", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/design-review.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-151b65fb4642ab6b", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/agents/incident-responder.md"}, "properties": {"repobilityId": "1def6a36cacf8032", "scanner": "scanner-primary", "fingerprint": "151b65fb4642ab6b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/incident-responder.md"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-811b9c16cadc4d67", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agents/incident-responder.md"}, "properties": {"repobilityId": "7d53ecdec2e04aef", "scanner": "scanner-primary", "fingerprint": "811b9c16cadc4d67", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/incident-responder.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a49e6063eaba5286", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/skills/fastapi-route/SKILL.md"}, "properties": {"repobilityId": "41f469a1289a966c", "scanner": "scanner-primary", "fingerprint": "a49e6063eaba5286", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/fastapi-route/SKILL.md"}, "region": {"startLine": 127}}}]}, {"ruleId": "scanner-7acd8f13a00f0a98", "level": "none", "message": {"text": "Commented-code block (9 lines) in tasks.py:510"}, "properties": {"repobilityId": "41a7dbabb407c7b3", "scanner": "scanner-primary", "fingerprint": "7acd8f13a00f0a98", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0b3036dd226aa4bb", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 tasks.py:600"}, "properties": {"repobilityId": "a9235765b019dc57", "scanner": "scanner-primary", "fingerprint": "0b3036dd226aa4bb", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-74fd9521ab0e4ef2", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/integration/conftest.py:20"}, "properties": {"repobilityId": "4fe3d3c448de14b2", "scanner": "scanner-primary", "fingerprint": "74fd9521ab0e4ef2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-97479b4123618a56", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/unit/test_storage.py:141"}, "properties": {"repobilityId": "97c68a8c9938e9ad", "scanner": "scanner-primary", "fingerprint": "97479b4123618a56", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9b3ffca846da1827", "level": "note", "message": {"text": "Legacy-named symbol `_extract_legacy` in tests/unit/test_csp.py:8"}, "properties": {"repobilityId": "edf8f1914d6f8657", "scanner": "scanner-primary", "fingerprint": "9b3ffca846da1827", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-82c310e2021c161f", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/unit/test_mcp_auth.py:535"}, "properties": {"repobilityId": "199bc86d423009d5", "scanner": "scanner-primary", "fingerprint": "82c310e2021c161f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d44e0ddc952d5772", "level": "none", "message": {"text": "Commented-code block (8 lines) in tests/unit/test_chat_agent.py:561"}, "properties": {"repobilityId": "53bd74737c329d43", "scanner": "scanner-primary", "fingerprint": "d44e0ddc952d5772", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4054b6240d265c59", "level": "none", "message": {"text": "Commented-code block (11 lines) in tests/unit/test_tools_web_search.py:32"}, "properties": {"repobilityId": "75f0c434d9ce5bc9", "scanner": "scanner-primary", "fingerprint": "4054b6240d265c59", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f4e54afe46ce1bf1", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/unit/test_chats_api.py:539"}, "properties": {"repobilityId": "f96824e1a6461e3f", "scanner": "scanner-primary", "fingerprint": "f4e54afe46ce1bf1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b15fe8c7e5948290", "level": "none", "message": {"text": "Commented-code block (7 lines) in tests/unit/test_tools_web_fetch.py:233"}, "properties": {"repobilityId": "30578c1060f8bce2", "scanner": "scanner-primary", "fingerprint": "b15fe8c7e5948290", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d6883de8c4ed2676", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/unit/test_tool_hooks.py:467"}, "properties": {"repobilityId": "9fe1e29b319f294b", "scanner": "scanner-primary", "fingerprint": "d6883de8c4ed2676", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f0f8540ed998d8d2", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/unit/test_check_agent_safe_scope.py:585"}, "properties": {"repobilityId": "42e900c0f77143ae", "scanner": "scanner-primary", "fingerprint": "f0f8540ed998d8d2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d6150b1f039d89df", "level": "none", "message": {"text": "Commented-code block (13 lines) in tests/unit/test_strands_sse.py:243"}, "properties": {"repobilityId": "f7ce7a3a464a4f30", "scanner": "scanner-primary", "fingerprint": "d6150b1f039d89df", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-07907a3850b17448", "level": "none", "message": {"text": "Commented-code block (13 lines) in tests/e2e/test_memory_recall_and_titling.py:98"}, "properties": {"repobilityId": "b6a8e99c915e351d", "scanner": "scanner-primary", "fingerprint": "07907a3850b17448", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2a47f511933917d8", "level": "none", "message": {"text": "Commented-code block (7 lines) in tests/e2e/test_attachments.py:308"}, "properties": {"repobilityId": "6cf653a85059d776", "scanner": "scanner-primary", "fingerprint": "2a47f511933917d8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ea1dfbce4cee5a31", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/e2e/test_tool_use_smoke.py:111"}, "properties": {"repobilityId": "567c29eb18a43f9d", "scanner": "scanner-primary", "fingerprint": "ea1dfbce4cee5a31", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d9eac484b36f138c", "level": "none", "message": {"text": "Commented-code block (5 lines) in ui/src/api.js:20"}, "properties": {"repobilityId": "b6dffeee868712d5", "scanner": "scanner-primary", "fingerprint": "d9eac484b36f138c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4b758dfbe956ba87", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 ui/src/api.js:27"}, "properties": {"repobilityId": "c0e8e18ef105ed5d", "scanner": "scanner-primary", "fingerprint": "4b758dfbe956ba87", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-8ef797eadc96f5d6", "level": "none", "message": {"text": "Commented-code block (6 lines) in ui/src/setupTests.js:14"}, "properties": {"repobilityId": "1ae6c788a346f54d", "scanner": "scanner-primary", "fingerprint": "8ef797eadc96f5d6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d90d2bdae85f4fa4", "level": "none", "message": {"text": "Commented-code block (7 lines) in ui/src/components/ErrorBoundary.test.jsx:95"}, "properties": {"repobilityId": "7639deeca17b9525", "scanner": "scanner-primary", "fingerprint": "d90d2bdae85f4fa4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fda841b44f8ab14f", "level": "none", "message": {"text": "Commented-code block (5 lines) in ui/src/app/Conversation.jsx:21"}, "properties": {"repobilityId": "b4b2efd077277656", "scanner": "scanner-primary", "fingerprint": "fda841b44f8ab14f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fbf108c76b5141d5", "level": "none", "message": {"text": "Commented-code block (5 lines) in ui/src/app/Conversation.test.jsx:689"}, "properties": {"repobilityId": "126d8ec4da050d2c", "scanner": "scanner-primary", "fingerprint": "fbf108c76b5141d5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-001047312f4c3147", "level": "none", "message": {"text": "Commented-code block (8 lines) in ui/src/app/Sidebar.jsx:74"}, "properties": {"repobilityId": "2b8e8f4252664ed8", "scanner": "scanner-primary", "fingerprint": "001047312f4c3147", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3c37baaf08eebbff", "level": "none", "message": {"text": "Commented-code block (5 lines) in ui/src/app/Shell.test.jsx:72"}, "properties": {"repobilityId": "d20b2ae3809f5cde", "scanner": "scanner-primary", "fingerprint": "3c37baaf08eebbff", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f9434973b6687bc7", "level": "none", "message": {"text": "Commented-code block (5 lines) in ui/src/app/MCPPicker.jsx:61"}, "properties": {"repobilityId": "d67966bb7234d421", "scanner": "scanner-primary", "fingerprint": "f9434973b6687bc7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-71d6f68557cfcfb7", "level": "none", "message": {"text": "Commented-code block (7 lines) in ui/src/app/data.js:21"}, "properties": {"repobilityId": "ed77878f369989e7", "scanner": "scanner-primary", "fingerprint": "71d6f68557cfcfb7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-aebc37b586994b35", "level": "none", "message": {"text": "Commented-code block (7 lines) in ui/src/app/ToolResultBlock.test.jsx:123"}, "properties": {"repobilityId": "5e9d8bfba977a0bd", "scanner": "scanner-primary", "fingerprint": "aebc37b586994b35", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-785e8d19da530105", "level": "none", "message": {"text": "Commented-code block (6 lines) in ui/src/app/Composer.jsx:285"}, "properties": {"repobilityId": "1f7f3c3e2f3fc959", "scanner": "scanner-primary", "fingerprint": "785e8d19da530105", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-87642fe0e72ff829", "level": "none", "message": {"text": "Commented-code block (5 lines) in ui/src/app/ToolResultBlock.jsx:3"}, "properties": {"repobilityId": "34472b0869ec4cc0", "scanner": "scanner-primary", "fingerprint": "87642fe0e72ff829", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ab92a16b9851ef46", "level": "none", "message": {"text": "Commented-code block (5 lines) in ui/src/app/views/Customize.jsx:26"}, "properties": {"repobilityId": "60bb8d66ba0dd7e7", "scanner": "scanner-primary", "fingerprint": "ab92a16b9851ef46", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ff41168bb1bca226", "level": "none", "message": {"text": "Commented-code block (6 lines) in ui/src/marketing/pages/Download.test.jsx:43"}, "properties": {"repobilityId": "ef8cd917bfeba893", "scanner": "scanner-primary", "fingerprint": "ff41168bb1bca226", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2cbdf834aafeeda3", "level": "none", "message": {"text": "Commented-code block (6 lines) in ui/src/hooks/useChatStream.js:6"}, "properties": {"repobilityId": "6067f624f993a948", "scanner": "scanner-primary", "fingerprint": "2cbdf834aafeeda3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7dc57a5bb240a4a0", "level": "none", "message": {"text": "Commented-code block (5 lines) in ui/src/hooks/useChannelPrefs.js:71"}, "properties": {"repobilityId": "9b5051a2fd5798fd", "scanner": "scanner-primary", "fingerprint": "7dc57a5bb240a4a0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d0d37cb37747299c", "level": "none", "message": {"text": "Commented-code block (8 lines) in ui/src/hooks/useChatStream.test.js:530"}, "properties": {"repobilityId": "02df0e6b2863ee82", "scanner": "scanner-primary", "fingerprint": "d0d37cb37747299c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4d49e0290ee32728", "level": "none", "message": {"text": "Commented-code block (7 lines) in scripts/check_branch_protection_drift.py:154"}, "properties": {"repobilityId": "e08cbfbeb1ffb398", "scanner": "scanner-primary", "fingerprint": "4d49e0290ee32728", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-332e57b41c731d54", "level": "none", "message": {"text": "Commented-code block (7 lines) in scripts/check_agent_safe_scope.py:237"}, "properties": {"repobilityId": "b59425adea39966f", "scanner": "scanner-primary", "fingerprint": "332e57b41c731d54", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9b4b6b8ccf17eeaa", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/check_agent_safe_scope.py:580"}, "properties": {"repobilityId": "235c99dcb9f4195d", "scanner": "scanner-primary", "fingerprint": "9b4b6b8ccf17eeaa", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-78ed918cfaec30cb", "level": "none", "message": {"text": "Commented-code block (5 lines) in desktop/test/protocol.test.js:92"}, "properties": {"repobilityId": "99a4b06b9f0038b1", "scanner": "scanner-primary", "fingerprint": "78ed918cfaec30cb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a8259ec8f84905c3", "level": "none", "message": {"text": "Commented-code block (5 lines) in desktop/test/smoke.js:11"}, "properties": {"repobilityId": "c747151515c1d4d4", "scanner": "scanner-primary", "fingerprint": "a8259ec8f84905c3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-13fc9ca13e46a9de", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 desktop/scripts/generate_icon.py:149"}, "properties": {"repobilityId": "1feae8fb8b4d13e0", "scanner": "scanner-primary", "fingerprint": "13fc9ca13e46a9de", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-6bbd46537d614a3f", "level": "none", "message": {"text": "Commented-code block (6 lines) in desktop/main/window.js:4"}, "properties": {"repobilityId": "31f01613262dc37e", "scanner": "scanner-primary", "fingerprint": "6bbd46537d614a3f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-aee8103ff0ad6cc3", "level": "none", "message": {"text": "Commented-code block (5 lines) in desktop/main/updater.js:30"}, "properties": {"repobilityId": "75da4211aa3636c7", "scanner": "scanner-primary", "fingerprint": "aee8103ff0ad6cc3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3ba4ac7b96032a23", "level": "none", "message": {"text": "Commented-code block (6 lines) in desktop/main/index.js:37"}, "properties": {"repobilityId": "27e80aa5a12adbc9", "scanner": "scanner-primary", "fingerprint": "3ba4ac7b96032a23", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e8c61011358b8c6e", "level": "none", "message": {"text": "Commented-code block (7 lines) in .claude/skills/dynamodb-item/example.py:38"}, "properties": {"repobilityId": "576d17cce12c72de", "scanner": "scanner-primary", "fingerprint": "e8c61011358b8c6e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fca5d32fd4e48585", "level": "none", "message": {"text": "Commented-code block (5 lines) in .claude/skills/react-component/example.jsx:5"}, "properties": {"repobilityId": "e834d96df06970a4", "scanner": "scanner-primary", "fingerprint": "fca5d32fd4e48585", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2c73b5c40647d220", "level": "note", "message": {"text": "Legacy-named symbol `bucket_legacy` in infra/stacks/channel_stack.py:73"}, "properties": {"repobilityId": "e67ec2c3e411d1bf", "scanner": "scanner-primary", "fingerprint": "2c73b5c40647d220", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-c680a53be4d38d32", "level": "none", "message": {"text": "Commented-code block (8 lines) in infra/stacks/channel_stack.py:222"}, "properties": {"repobilityId": "e2e2bb9bd2360d76", "scanner": "scanner-primary", "fingerprint": "c680a53be4d38d32", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3176c19b9cce3419", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/channel/storage.py:651"}, "properties": {"repobilityId": "7cfd69e5f674e2a7", "scanner": "scanner-primary", "fingerprint": "3176c19b9cce3419", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2bec083652560a7f", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/channel/models.py:91"}, "properties": {"repobilityId": "856dab29a4e11c32", "scanner": "scanner-primary", "fingerprint": "2bec083652560a7f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f7003455b6856e8f", "level": "none", "message": {"text": "Commented-code block (8 lines) in src/channel/auth/mgmt_auth.py:146"}, "properties": {"repobilityId": "9068db6f04e6632b", "scanner": "scanner-primary", "fingerprint": "f7003455b6856e8f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f0d59826d2dd5dfb", "level": "none", "message": {"text": "Commented-code block (8 lines) in src/channel/auth/state_store.py:142"}, "properties": {"repobilityId": "f9bd6084ae61e4d8", "scanner": "scanner-primary", "fingerprint": "f0d59826d2dd5dfb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c8be82e9b0874e4f", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/channel/auth/logout.py:80"}, "properties": {"repobilityId": "a5fb1ece59243ada", "scanner": "scanner-primary", "fingerprint": "c8be82e9b0874e4f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-25392aed4264af22", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/channel/api/mcp.py:61"}, "properties": {"repobilityId": "9031210694b2ca81", "scanner": "scanner-primary", "fingerprint": "25392aed4264af22", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8c815fcf2425bac3", "level": "note", "message": {"text": "Legacy-named symbol `_extract_legacy` in src/channel/api/csp.py:35"}, "properties": {"repobilityId": "9572cf8623fc5c03", "scanner": "scanner-primary", "fingerprint": "8c815fcf2425bac3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-f9a901fca60c2269", "level": "none", "message": {"text": "Commented-code block (8 lines) in src/channel/api/chats.py:131"}, "properties": {"repobilityId": "5863f80f300ee1e8", "scanner": "scanner-primary", "fingerprint": "f9a901fca60c2269", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-95160b6ed695b943", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/channel/api/_auth.py:37"}, "properties": {"repobilityId": "c69f5e82d77754cc", "scanner": "scanner-primary", "fingerprint": "95160b6ed695b943", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e72ed35b1c47d819", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/channel/api/main.py:40"}, "properties": {"repobilityId": "ba540d3ba5e40668", "scanner": "scanner-primary", "fingerprint": "e72ed35b1c47d819", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2ea0765b40625826", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/channel/api/attachments.py:215"}, "properties": {"repobilityId": "1cf2499e571e7a2a", "scanner": "scanner-primary", "fingerprint": "2ea0765b40625826", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9b2a381172d4064d", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/channel/mcp/transports.py:44"}, "properties": {"repobilityId": "2cb3e3811b7e8d6b", "scanner": "scanner-primary", "fingerprint": "9b2a381172d4064d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c17cf1eac1480cd8", "level": "none", "message": {"text": "Commented-code block (8 lines) in src/channel/sandbox/handler.py:280"}, "properties": {"repobilityId": "d0e656e22ad54735", "scanner": "scanner-primary", "fingerprint": "c17cf1eac1480cd8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d8cc4ba254651316", "level": "none", "message": {"text": "Commented-code block (9 lines) in src/channel/agents/tool_hooks.py:78"}, "properties": {"repobilityId": "83f1812fddd0b854", "scanner": "scanner-primary", "fingerprint": "d8cc4ba254651316", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c170c666ac57ded4", "level": "none", "message": {"text": "Commented-code block (10 lines) in src/channel/agents/recall.py:208"}, "properties": {"repobilityId": "4d9b3f282dec0486", "scanner": "scanner-primary", "fingerprint": "c170c666ac57ded4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1ff9433e8aca906e", "level": "none", "message": {"text": "Commented-code block (8 lines) in src/channel/agents/chat_agent.py:35"}, "properties": {"repobilityId": "62ba5d9f35a626f3", "scanner": "scanner-primary", "fingerprint": "1ff9433e8aca906e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3345667749461aa9", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/channel/agents/memory.py:34"}, "properties": {"repobilityId": "3f4bb98085d4b69a", "scanner": "scanner-primary", "fingerprint": "3345667749461aa9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6906d1ab43e3d204", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/channel/agents/strands_sse.py:18"}, "properties": {"repobilityId": "9942f3bd8e86a75a", "scanner": "scanner-primary", "fingerprint": "6906d1ab43e3d204", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-471b8140ce972062", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/channel/agents/tools/web_search.py:48"}, "properties": {"repobilityId": "571d40cfc7b65602", "scanner": "scanner-primary", "fingerprint": "471b8140ce972062", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-feb4c2164e063fcd", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/channel/agents/tools/code_exec.py:116"}, "properties": {"repobilityId": "8257cb3a2674142e", "scanner": "scanner-primary", "fingerprint": "feb4c2164e063fcd", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cce556a852eea36b", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/channel/agents/tools/web_fetch.py:59"}, "properties": {"repobilityId": "f2ec7b1c930b2bba", "scanner": "scanner-primary", "fingerprint": "cce556a852eea36b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "09fd5fef688b4741", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "3fef04effaa5ccee", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "a346402e6ea59e26", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "91f474eccc55a2e5", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-b9f1b79c317bdc63", "level": "warning", "message": {"text": "Frontend route `/app/c/:id` has no Link/navigate to it \u2014 ui/src/app/views/ProjectDetail.test.jsx"}, "properties": {"repobilityId": "1615e541c1cdb775", "scanner": "scanner-primary", "fingerprint": "b9f1b79c317bdc63", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-bd44498e50e03862", "level": "warning", "message": {"text": "Frontend route `/app/projects/:id` has no Link/navigate to it \u2014 ui/src/app/views/Projects.test.jsx"}, "properties": {"repobilityId": "4e817cbcd0b025fe", "scanner": "scanner-primary", "fingerprint": "bd44498e50e03862", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-72daaa97e6a28ee0", "level": "warning", "message": {"text": "Frontend route `/app/c/:id?` has no Link/navigate to it \u2014 ui/src/app/Conversation.test.jsx"}, "properties": {"repobilityId": "f80fc2d2b1c56e6f", "scanner": "scanner-primary", "fingerprint": "72daaa97e6a28ee0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-8743c7cdcee750f2", "level": "warning", "message": {"text": "Frontend route `/app/*` has no Link/navigate to it \u2014 ui/src/app/ChatHeader.test.jsx"}, "properties": {"repobilityId": "6da655caeb15d863", "scanner": "scanner-primary", "fingerprint": "8743c7cdcee750f2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-dda551a44533d855", "level": "error", "message": {"text": "FastAPI POST `receive_csp_report` without auth dependency \u2014 src/channel/api/csp.py:95"}, "properties": {"repobilityId": "5d901a4240d888bb", "scanner": "scanner-primary", "fingerprint": "dda551a44533d855", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/channel/api/csp.py"}, "region": {"startLine": 95}}}]}, {"ruleId": "scanner-f43d2071795b9dfa", "level": "note", "message": {"text": "Unused endpoint: POST /widgets"}, "properties": {"repobilityId": "c797892bf6647c5b", "scanner": "scanner-primary", "fingerprint": "f43d2071795b9dfa", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-18f088c4b5c6ece4", "level": "note", "message": {"text": "Unused endpoint: POST /widgets/stream"}, "properties": {"repobilityId": "95eec405dfa20a4e", "scanner": "scanner-primary", "fingerprint": "18f088c4b5c6ece4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-76fe223a158845f6", "level": "note", "message": {"text": "Unused endpoint: GET /auth/login"}, "properties": {"repobilityId": "d3c3c39069c9556e", "scanner": "scanner-primary", "fingerprint": "76fe223a158845f6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1480187b44a5fd90", "level": "note", "message": {"text": "Unused endpoint: GET /auth/callback"}, "properties": {"repobilityId": "552282862f41193b", "scanner": "scanner-primary", "fingerprint": "1480187b44a5fd90", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c059f57186114027", "level": "note", "message": {"text": "Unused endpoint: POST /auth/logout"}, "properties": {"repobilityId": "43ecc4a6a9be3e86", "scanner": "scanner-primary", "fingerprint": "c059f57186114027", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e9ecd5ae1040af7e", "level": "note", "message": {"text": "Unused endpoint: GET /api/mcp/servers"}, "properties": {"repobilityId": "1759dc200c3dc5c0", "scanner": "scanner-primary", "fingerprint": "e9ecd5ae1040af7e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3163641cea3a5b6a", "level": "note", "message": {"text": "Unused endpoint: POST /api/mcp/servers"}, "properties": {"repobilityId": "6e4f3448b705e562", "scanner": "scanner-primary", "fingerprint": "3163641cea3a5b6a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-eb6c7ec2212f1cf3", "level": "note", "message": {"text": "Unused endpoint: GET /auth/mcp/callback"}, "properties": {"repobilityId": "ae6fada941316e42", "scanner": "scanner-primary", "fingerprint": "eb6c7ec2212f1cf3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a53cd65b8ab5d353", "level": "note", "message": {"text": "Unused endpoint: PATCH /api/mcp/servers/{server_id}"}, "properties": {"repobilityId": "b6aa7497eafbc0e0", "scanner": "scanner-primary", "fingerprint": "a53cd65b8ab5d353", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ba2e286cd2255a8b", "level": "note", "message": {"text": "Unused endpoint: DELETE /api/mcp/servers/{server_id}"}, "properties": {"repobilityId": "c8e3e1401cf5ffbb", "scanner": "scanner-primary", "fingerprint": "ba2e286cd2255a8b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5eea6ec523138e72", "level": "note", "message": {"text": "Unused endpoint: POST /api/mcp/servers/{server_id}/reauth"}, "properties": {"repobilityId": "2a1a2f63ca6d2aea", "scanner": "scanner-primary", "fingerprint": "5eea6ec523138e72", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-005ae9c858e09556", "level": "note", "message": {"text": "Unused endpoint: GET /api/chats/{chat_id}/mcp"}, "properties": {"repobilityId": "a4e70aa2e9c5a8da", "scanner": "scanner-primary", "fingerprint": "005ae9c858e09556", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-93e53bb87b44886e", "level": "note", "message": {"text": "Unused endpoint: PUT /api/chats/{chat_id}/mcp"}, "properties": {"repobilityId": "0bd4d15d5c28f3cd", "scanner": "scanner-primary", "fingerprint": "93e53bb87b44886e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f6e1ffc380b91ae1", "level": "note", "message": {"text": "Unused endpoint: POST /csp-report"}, "properties": {"repobilityId": "0e24a3fb7ab30ec9", "scanner": "scanner-primary", "fingerprint": "f6e1ffc380b91ae1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-80a8dac1d2e5a55e", "level": "note", "message": {"text": "Unused endpoint: GET /api/me/prefs"}, "properties": {"repobilityId": "516a13f167b664fa", "scanner": "scanner-primary", "fingerprint": "80a8dac1d2e5a55e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f4b64137568b745d", "level": "note", "message": {"text": "Unused endpoint: PUT /api/me/prefs"}, "properties": {"repobilityId": "15e98e22167723ab", "scanner": "scanner-primary", "fingerprint": "f4b64137568b745d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8b80a7b7877ecc38", "level": "note", "message": {"text": "Unused endpoint: GET /memory/events"}, "properties": {"repobilityId": "baf459e6aecc55ab", "scanner": "scanner-primary", "fingerprint": "8b80a7b7877ecc38", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e15d5c2bceef4423", "level": "note", "message": {"text": "Unused endpoint: DELETE /memory/events"}, "properties": {"repobilityId": "7a820430a0806649", "scanner": "scanner-primary", "fingerprint": "e15d5c2bceef4423", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7a009b1a56794f45", "level": "note", "message": {"text": "Unused endpoint: POST /"}, "properties": {"repobilityId": "c92b8c914003d140", "scanner": "scanner-primary", "fingerprint": "7a009b1a56794f45", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "edce2497f877f86b", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ac5c6ba288e40fb1", "level": "note", "message": {"text": "Unused endpoint: GET /{chat_id}"}, "properties": {"repobilityId": "7c01ce0d5bd34e43", "scanner": "scanner-primary", "fingerprint": "ac5c6ba288e40fb1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e43e51e7c596b026", "level": "note", "message": {"text": "Unused endpoint: PATCH /{chat_id}"}, "properties": {"repobilityId": "b023a7d63ee27687", "scanner": "scanner-primary", "fingerprint": "e43e51e7c596b026", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-193885acf8185891", "level": "note", "message": {"text": "Unused endpoint: DELETE /{chat_id}"}, "properties": {"repobilityId": "7b3402bb27e0382a", "scanner": "scanner-primary", "fingerprint": "193885acf8185891", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-71eb7e7ba4d3fc96", "level": "note", "message": {"text": "Unused endpoint: POST /{chat_id}/messages"}, "properties": {"repobilityId": "b269ae6016209bc1", "scanner": "scanner-primary", "fingerprint": "71eb7e7ba4d3fc96", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b6b50693aeef5afd", "level": "note", "message": {"text": "Unused endpoint: POST /{chat_id}/regenerate"}, "properties": {"repobilityId": "a03f04ab3dc436f7", "scanner": "scanner-primary", "fingerprint": "b6b50693aeef5afd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3700a5f47e4287c8", "level": "note", "message": {"text": "Unused endpoint: POST /{chat_id}/messages/{msg_id}/feedback"}, "properties": {"repobilityId": "48efb4253ec58417", "scanner": "scanner-primary", "fingerprint": "3700a5f47e4287c8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2ab9bf5db6820af4", "level": "note", "message": {"text": "Unused endpoint: GET /models"}, "properties": {"repobilityId": "6c567c570d8fa34c", "scanner": "scanner-primary", "fingerprint": "2ab9bf5db6820af4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-23df988e26cdbbc9", "level": "note", "message": {"text": "Unused endpoint: POST /presign"}, "properties": {"repobilityId": "f73f3ce33c53a8c0", "scanner": "scanner-primary", "fingerprint": "23df988e26cdbbc9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}