{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-19891546e4fc074c", "name": "Possibly dead Python function: decorator", "shortDescription": {"text": "Possibly dead Python function: decorator"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-277ecf486208332e", "name": "Possibly dead Python function: triage_node", "shortDescription": {"text": "Possibly dead Python function: triage_node"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ed9f3d0e9d5064e0", "name": "Possibly dead Python function: route_node", "shortDescription": {"text": "Possibly dead Python function: route_node"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fc6d88373dfd449d", "name": "Possibly dead Python function: reproduce_node", "shortDescription": {"text": "Possibly dead Python function: reproduce_node"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-52b8511841d54c08", "name": "Possibly dead Python function: hypothesize_node", "shortDescription": {"text": "Possibly dead Python function: hypothesize_node"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9c0685bbcb5a5ba6", "name": "Possibly dead Python function: patch_node", "shortDescription": {"text": "Possibly dead Python function: patch_node"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-58e0ef96b23d69c3", "name": "Possibly dead Python function: test_node", "shortDescription": {"text": "Possibly dead Python function: test_node"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3135155e4e8b1ece", "name": "Possibly dead Python function: verify_node", "shortDescription": {"text": "Possibly dead Python function: verify_node"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d6c700d58432e554", "name": "Possibly dead Python function: open_pr_node", "shortDescription": {"text": "Possibly dead Python function: open_pr_node"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-da7c6d486a74e22f", "name": "Possibly dead Python function: give_up_node", "shortDescription": {"text": "Possibly dead Python function: give_up_node"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e285fec55a6124fb", "name": "Possibly dead Python function: route_after_triage", "shortDescription": {"text": "Possibly dead Python function: route_after_triage"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0c2b5968be47c323", "name": "Possibly dead Python function: route_after_reproduce", "shortDescription": {"text": "Possibly dead Python function: route_after_reproduce"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-59ab028e2d7d54fc", "name": "Possibly dead Python function: route_after_test", "shortDescription": {"text": "Possibly dead Python function: route_after_test"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a4d81e8d9acf4922", "name": "Possibly dead Python function: route_after_verify", "shortDescription": {"text": "Possibly dead Python function: route_after_verify"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d415beb7bc086a5b", "name": "`truncate` class without `title=` for hover reveal \u2014 dashboard/src/components/ActivityStream.tsx:30", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 dashboard/src/components/ActivityStream.tsx:30"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-27924aa79fa4a517", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "astral-sh/setup-uv@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2bb3068e66471076", "name": "Legacy-named symbol `model_copy` in tests/test_policy_audit.py:107", "shortDescription": {"text": "Legacy-named symbol `model_copy` in tests/test_policy_audit.py:107"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4ac218f7bd041138", "name": "Legacy-named symbol `model_copy` in src/steward/policy/audit.py:157", "shortDescription": {"text": "Legacy-named symbol `model_copy` in src/steward/policy/audit.py:157"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-377818b5f57357e8", "name": "Legacy-named symbol `model_copy` in src/steward/policy/approvals.py:147", "shortDescription": {"text": "Legacy-named symbol `model_copy` in src/steward/policy/approvals.py:147"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6769b1e9e15fe2c3", "name": "Stub function `record` (body is just `pass`/`return`) \u2014 src/steward/observability/tracing.py:129", "shortDescription": {"text": "Stub function `record` (body is just `pass`/`return`) \u2014 src/steward/observability/tracing.py:129"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-63bcd88fe782fe28", "name": "Legacy-named symbol `pending_old` in src/steward/fix/patch.py:57", "shortDescription": {"text": "Legacy-named symbol `pending_old` in src/steward/fix/patch.py:57"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9bd08fa7001f93a8", "name": "Legacy-named symbol `model_copy` in src/steward/fix/prooftest.py:68", "shortDescription": {"text": "Legacy-named symbol `model_copy` in src/steward/fix/prooftest.py:68"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nsrc/steward/triage/dedup.py:model, src/steward/triage/dedup.py:model\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nsrc/steward/triage/dedup.py:embed, src/steward/triage/dedup.py:embed, src/steward/triage/dedup.py:embed\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49c98f7cedd9c977", "name": "Near-duplicate function bodies in 4 places", "shortDescription": {"text": "Near-duplicate function bodies in 4 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nsrc/steward/observability/tracing.py:record_usage, src/steward/observability/tracing.py:record, src/steward/observability/tracing.py:record, src/steward/observability/tracing.py:record\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-02525d39071dd2c7", "name": "Near-duplicate function bodies in 5 places", "shortDescription": {"text": "Near-duplicate function bodies in 5 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nsrc/steward/observability/tracing.py:flush, src/steward/observability/tracing.py:flush, src/steward/observability/tracing.py:flush, src/steward/observability/tracing.py:flush\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6222a634175e854a", "name": "FastAPI POST `approve` without auth dependency \u2014 src/steward/api/app.py:99", "shortDescription": {"text": "FastAPI POST `approve` without auth dependency \u2014 src/steward/api/app.py:99"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b85a79b32495dc0c", "name": "FastAPI POST `reject` without auth dependency \u2014 src/steward/api/app.py:117", "shortDescription": {"text": "FastAPI POST `reject` without auth dependency \u2014 src/steward/api/app.py:117"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4756b4c4da7d2088", "name": "Unused endpoint: GET /api/health", "shortDescription": {"text": "Unused endpoint: GET /api/health"}, "fullDescription": {"text": "`src/steward/api/app.py` declares `GET /api/health` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5661247f2d823a9b", "name": "Unused endpoint: GET /api/actions", "shortDescription": {"text": "Unused endpoint: GET /api/actions"}, "fullDescription": {"text": "`src/steward/api/app.py` declares `GET /api/actions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1152fa7acf7dabb7", "name": "Unused endpoint: GET /api/approvals", "shortDescription": {"text": "Unused endpoint: GET /api/approvals"}, "fullDescription": {"text": "`src/steward/api/app.py` declares `GET /api/approvals` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-79645fd9b5f91ecd", "name": "Unused endpoint: POST /api/approvals/{approval_id}/approve", "shortDescription": {"text": "Unused endpoint: POST /api/approvals/{approval_id}/approve"}, "fullDescription": {"text": "`src/steward/api/app.py` declares `POST /api/approvals/{approval_id}/approve` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b8b68bf762206d5b", "name": "Unused endpoint: POST /api/approvals/{approval_id}/reject", "shortDescription": {"text": "Unused endpoint: POST /api/approvals/{approval_id}/reject"}, "fullDescription": {"text": "`src/steward/api/app.py` declares `POST /api/approvals/{approval_id}/reject` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be674d5115c6d27b", "name": "Unused endpoint: GET /api/scorecard", "shortDescription": {"text": "Unused endpoint: GET /api/scorecard"}, "fullDescription": {"text": "`src/steward/api/app.py` declares `GET /api/scorecard` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/22357"}, "properties": {"repository": "vivekanjana76/steward", "repoUrl": "https://github.com/vivekanjana76/steward", "branch": "main"}, "results": [{"ruleId": "scanner-19891546e4fc074c", "level": "note", "message": {"text": "Possibly dead Python function: decorator"}, "properties": {"repobilityId": "ffbcbc9bc189af1c", "scanner": "scanner-primary", "fingerprint": "19891546e4fc074c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/steward/observability/tracing.py:261"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-277ecf486208332e", "level": "note", "message": {"text": "Possibly dead Python function: triage_node"}, "properties": {"repobilityId": "628586335b27e9ac", "scanner": "scanner-primary", "fingerprint": "277ecf486208332e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/steward/graph/nodes.py:35"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ed9f3d0e9d5064e0", "level": "note", "message": {"text": "Possibly dead Python function: route_node"}, "properties": {"repobilityId": "cc1ba81ea2a23299", "scanner": "scanner-primary", "fingerprint": "ed9f3d0e9d5064e0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/steward/graph/nodes.py:44"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fc6d88373dfd449d", "level": "note", "message": {"text": "Possibly dead Python function: reproduce_node"}, "properties": {"repobilityId": "3b43fa1f0e692e61", "scanner": "scanner-primary", "fingerprint": "fc6d88373dfd449d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/steward/graph/nodes.py:63"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-52b8511841d54c08", "level": "note", "message": {"text": "Possibly dead Python function: hypothesize_node"}, "properties": {"repobilityId": "94950cb1364fc282", "scanner": "scanner-primary", "fingerprint": "52b8511841d54c08", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/steward/graph/nodes.py:77"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9c0685bbcb5a5ba6", "level": "note", "message": {"text": "Possibly dead Python function: patch_node"}, "properties": {"repobilityId": "3027f5432bb65346", "scanner": "scanner-primary", "fingerprint": "9c0685bbcb5a5ba6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/steward/graph/nodes.py:83"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-58e0ef96b23d69c3", "level": "note", "message": {"text": "Possibly dead Python function: test_node"}, "properties": {"repobilityId": "7f3466851fb1ccfa", "scanner": "scanner-primary", "fingerprint": "58e0ef96b23d69c3", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/steward/graph/nodes.py:89"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3135155e4e8b1ece", "level": "note", "message": {"text": "Possibly dead Python function: verify_node"}, "properties": {"repobilityId": "09e8def09d49e604", "scanner": "scanner-primary", "fingerprint": "3135155e4e8b1ece", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/steward/graph/nodes.py:101"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d6c700d58432e554", "level": "note", "message": {"text": "Possibly dead Python function: open_pr_node"}, "properties": {"repobilityId": "997786edb46cb21f", "scanner": "scanner-primary", "fingerprint": "d6c700d58432e554", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/steward/graph/nodes.py:123"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-da7c6d486a74e22f", "level": "note", "message": {"text": "Possibly dead Python function: give_up_node"}, "properties": {"repobilityId": "8a1f16de9272ff52", "scanner": "scanner-primary", "fingerprint": "da7c6d486a74e22f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/steward/graph/nodes.py:133"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e285fec55a6124fb", "level": "note", "message": {"text": "Possibly dead Python function: route_after_triage"}, "properties": {"repobilityId": "60bb2be949cc7140", "scanner": "scanner-primary", "fingerprint": "e285fec55a6124fb", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/steward/graph/nodes.py:141"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0c2b5968be47c323", "level": "note", "message": {"text": "Possibly dead Python function: route_after_reproduce"}, "properties": {"repobilityId": "f81fcc84d6c3db3c", "scanner": "scanner-primary", "fingerprint": "0c2b5968be47c323", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/steward/graph/nodes.py:146"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-59ab028e2d7d54fc", "level": "note", "message": {"text": "Possibly dead Python function: route_after_test"}, "properties": {"repobilityId": "8b38dc0e62523332", "scanner": "scanner-primary", "fingerprint": "59ab028e2d7d54fc", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/steward/graph/nodes.py:152"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a4d81e8d9acf4922", "level": "note", "message": {"text": "Possibly dead Python function: route_after_verify"}, "properties": {"repobilityId": "746fd33f5b5b79fb", "scanner": "scanner-primary", "fingerprint": "a4d81e8d9acf4922", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/steward/graph/nodes.py:161"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d415beb7bc086a5b", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 dashboard/src/components/ActivityStream.tsx:30"}, "properties": {"repobilityId": "837138998cfae056", "scanner": "scanner-primary", "fingerprint": "d415beb7bc086a5b", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3beb6cb780c591da", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "989a74409a402368", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 53}}}]}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "6b372456d92903a4", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "1bb64b8f69ccfc8d", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "2c2c0109017ca6b4", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-2bb3068e66471076", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in tests/test_policy_audit.py:107"}, "properties": {"repobilityId": "b3a44d4d85f7f6c6", "scanner": "scanner-primary", "fingerprint": "2bb3068e66471076", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-4ac218f7bd041138", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in src/steward/policy/audit.py:157"}, "properties": {"repobilityId": "e0918212bef8e51c", "scanner": "scanner-primary", "fingerprint": "4ac218f7bd041138", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-377818b5f57357e8", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in src/steward/policy/approvals.py:147"}, "properties": {"repobilityId": "06ee4604aa61136c", "scanner": "scanner-primary", "fingerprint": "377818b5f57357e8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-6769b1e9e15fe2c3", "level": "note", "message": {"text": "Stub function `record` (body is just `pass`/`return`) \u2014 src/steward/observability/tracing.py:129"}, "properties": {"repobilityId": "ff77dfd1f1e0099d", "scanner": "scanner-primary", "fingerprint": "6769b1e9e15fe2c3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-63bcd88fe782fe28", "level": "note", "message": {"text": "Legacy-named symbol `pending_old` in src/steward/fix/patch.py:57"}, "properties": {"repobilityId": "9e100a83388cb1e5", "scanner": "scanner-primary", "fingerprint": "63bcd88fe782fe28", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-9bd08fa7001f93a8", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in src/steward/fix/prooftest.py:68"}, "properties": {"repobilityId": "afa95cc550226c35", "scanner": "scanner-primary", "fingerprint": "9bd08fa7001f93a8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "e17e3e6289971d27", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "9b1f0f1906e20637", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "aaadf07d005065ab", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "bc488f8129e3f094", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "cd108e5c6e784c0d", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "28ca1b6c33397014", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "6a845dff8af6b40f", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "605c697ffc6155e3", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-02525d39071dd2c7", "level": "note", "message": {"text": "Near-duplicate function bodies in 5 places"}, "properties": {"repobilityId": "a2fd9ba9df6c62ea", "scanner": "scanner-primary", "fingerprint": "02525d39071dd2c7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-6222a634175e854a", "level": "error", "message": {"text": "FastAPI POST `approve` without auth dependency \u2014 src/steward/api/app.py:99"}, "properties": {"repobilityId": "b4485bf5dd9d211b", "scanner": "scanner-primary", "fingerprint": "6222a634175e854a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/steward/api/app.py"}, "region": {"startLine": 99}}}]}, {"ruleId": "scanner-b85a79b32495dc0c", "level": "error", "message": {"text": "FastAPI POST `reject` without auth dependency \u2014 src/steward/api/app.py:117"}, "properties": {"repobilityId": "2256e625adec5598", "scanner": "scanner-primary", "fingerprint": "b85a79b32495dc0c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/steward/api/app.py"}, "region": {"startLine": 117}}}]}, {"ruleId": "scanner-4756b4c4da7d2088", "level": "note", "message": {"text": "Unused endpoint: GET /api/health"}, "properties": {"repobilityId": "480412c37dc571ae", "scanner": "scanner-primary", "fingerprint": "4756b4c4da7d2088", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5661247f2d823a9b", "level": "note", "message": {"text": "Unused endpoint: GET /api/actions"}, "properties": {"repobilityId": "17f593018cb47c3f", "scanner": "scanner-primary", "fingerprint": "5661247f2d823a9b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1152fa7acf7dabb7", "level": "note", "message": {"text": "Unused endpoint: GET /api/approvals"}, "properties": {"repobilityId": "cfa1061d807a14f6", "scanner": "scanner-primary", "fingerprint": "1152fa7acf7dabb7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-79645fd9b5f91ecd", "level": "note", "message": {"text": "Unused endpoint: POST /api/approvals/{approval_id}/approve"}, "properties": {"repobilityId": "cb81d778a9cd0946", "scanner": "scanner-primary", "fingerprint": "79645fd9b5f91ecd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b8b68bf762206d5b", "level": "note", "message": {"text": "Unused endpoint: POST /api/approvals/{approval_id}/reject"}, "properties": {"repobilityId": "61c0324607ca3376", "scanner": "scanner-primary", "fingerprint": "b8b68bf762206d5b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-be674d5115c6d27b", "level": "note", "message": {"text": "Unused endpoint: GET /api/scorecard"}, "properties": {"repobilityId": "c200d7bd82a64f4d", "scanner": "scanner-primary", "fingerprint": "be674d5115c6d27b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}