{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-7689d01be8e7df91", "name": "Possibly dead Python function: check_auth", "shortDescription": {"text": "Possibly dead Python function: check_auth"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-307ee839a7ea1172", "name": "Possibly dead Python function: connect", "shortDescription": {"text": "Possibly dead Python function: connect"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-60146976ca849bb9", "name": "Possibly dead Python function: preview_skeleton_stale", "shortDescription": {"text": "Possibly dead Python function: preview_skeleton_stale"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aaca3befe89bb28f", "name": "Possibly dead Python function: mark_skeleton_stale", "shortDescription": {"text": "Possibly dead Python function: mark_skeleton_stale"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-714c31ca9f474ae6", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d4f99a08805e6a47", "name": "Possible secret in scripts/gate_benchmark.py", "shortDescription": {"text": "Possible secret in scripts/gate_benchmark.py"}, "fullDescription": {"text": "Detected pattern matching generic_api_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-8d748463132c666a", "name": "Insecure pattern 'eval_used' in scripts/gate_benchmark.py:141", "shortDescription": {"text": "Insecure pattern 'eval_used' in scripts/gate_benchmark.py:141"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2aa0033ab01a76cc", "name": "Insecure pattern 'subprocess_shell_true' in skills/ha-build/run.py:384", "shortDescription": {"text": "Insecure pattern 'subprocess_shell_true' in skills/ha-build/run.py:384"}, "fullDescription": {"text": "Found a known-risky pattern (subprocess_shell_true). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-692ab71ff98012fc", "name": "Insecure pattern 'subprocess_shell_true' in skills/ha-smoke/run.py:70", "shortDescription": {"text": "Insecure pattern 'subprocess_shell_true' in skills/ha-smoke/run.py:70"}, "fullDescription": {"text": "Found a known-risky pattern (subprocess_shell_true). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ff7524b61dd45ba9", "name": "Insecure pattern 'eval_used' in backend/src/orchestrator/security_hooks.py:282", "shortDescription": {"text": "Insecure pattern 'eval_used' in backend/src/orchestrator/security_hooks.py:282"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4178e4c0057373ff", "name": "Insecure pattern 'exec_used' in backend/src/orchestrator/security_hooks.py:287", "shortDescription": {"text": "Insecure pattern 'exec_used' in backend/src/orchestrator/security_hooks.py:287"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-27924aa79fa4a517", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "astral-sh/setup-uv@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7e487cb8317c43b6", "name": "Very large file: backend/tests/orchestrator/test_plan_manager.py (1493 lines)", "shortDescription": {"text": "Very large file: backend/tests/orchestrator/test_plan_manager.py (1493 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a680c5a41542353", "name": "Very large file: backend/tests/orchestrator/test_profile_loader.py (2194 lines)", "shortDescription": {"text": "Very large file: backend/tests/orchestrator/test_profile_loader.py (2194 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 113 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 22 placeholder/mock markers across 7 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1cb17c4b674a4094", "name": "Agent authority lacks a verifier contract: skills/ha-redesign/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/ha-redesign/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fb4ebc725ceead1d", "name": "Agent authority lacks a verifier contract: skills/ha-ship/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/ha-ship/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9a7dcbfc0380243e", "name": "Agent instruction/config may expose a secret: skills/ha-review/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: skills/ha-review/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-dd56d9a6d50bede6", "name": "Agent authority lacks a verifier contract: skills/ha-log/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/ha-log/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6566e4a6866fff0b", "name": "Agent authority lacks a verifier contract: backend/agents/qa/CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: backend/agents/qa/CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1d931aa239cabd8c", "name": "Agent authority lacks a verifier contract: backend/agents/reviewer/CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: backend/agents/reviewer/CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-43cf774d26583089", "name": "Agent instruction/config may expose a secret: backend/agents/mobile_coder_ios/CLAUDE.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: backend/agents/mobile_coder_ios/CLAUDE.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c7650fbffc58ec18", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/gate_benchmark.py:139", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/gate_benchmark.py:139"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-041c32e29c400db9", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/benchmark.py:104", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/benchmark.py:104"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-10495c38717f1b40", "name": "Legacy-named symbol `is_legacy` in skills/ha-build/run.py:129", "shortDescription": {"text": "Legacy-named symbol `is_legacy` in skills/ha-build/run.py:129"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-edc72b258f7797ba", "name": "Commented-code block (5 lines) in skills/ha-build/run.py:468", "shortDescription": {"text": "Commented-code block (5 lines) in skills/ha-build/run.py:468"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f1964431f0d6f5c7", "name": "Legacy-named symbol `is_legacy` in skills/ha-redesign/run.py:123", "shortDescription": {"text": "Legacy-named symbol `is_legacy` in skills/ha-redesign/run.py:123"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f125a70a189a00ed", "name": "Commented-code block (5 lines) in skills/ha-redesign/run.py:310", "shortDescription": {"text": "Commented-code block (5 lines) in skills/ha-redesign/run.py:310"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-87a224f88a21f962", "name": "Legacy-named symbol `is_legacy` in skills/ha-plan/run.py:175", "shortDescription": {"text": "Legacy-named symbol `is_legacy` in skills/ha-plan/run.py:175"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-afe74b34c79aa644", "name": "Commented-code block (5 lines) in skills/ha-plan/run.py:287", "shortDescription": {"text": "Commented-code block (5 lines) in skills/ha-plan/run.py:287"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9876c07be050a224", "name": "Legacy-named symbol `is_legacy` in skills/ha-review/run.py:756", "shortDescription": {"text": "Legacy-named symbol `is_legacy` in skills/ha-review/run.py:756"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7de505fc59f5fad3", "name": "Commented-code block (5 lines) in skills/ha-review/run.py:106", "shortDescription": {"text": "Commented-code block (5 lines) in skills/ha-review/run.py:106"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-47d917246f1382eb", "name": "Legacy-named symbol `is_legacy` in skills/ha-verify/run.py:140", "shortDescription": {"text": "Legacy-named symbol `is_legacy` in skills/ha-verify/run.py:140"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ba9e7d6ba1e1033c", "name": "Legacy-named symbol `no_backup` in skills/ha-deepinit/run.py:145", "shortDescription": {"text": "Legacy-named symbol `no_backup` in skills/ha-deepinit/run.py:145"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9fe2e19bb7324abb", "name": "Legacy-named symbol `add_backup` in backend/tests/orchestrator/test_plan_manager.py:269", "shortDescription": {"text": "Legacy-named symbol `add_backup` in backend/tests/orchestrator/test_plan_manager.py:269"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dca0abf6c156e7f5", "name": "Legacy-named symbol `test_cli_graph_inject_creates_backup` in backend/tests/orchestrator/test_graph_cli.py:109", "shortDescription": {"text": "Legacy-named symbol `test_cli_graph_inject_creates_backup` in backend/tests/orchestrator/test_graph_cli.py:109"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e0adf1172bb45db5", "name": "Legacy-named symbol `no_backup` in backend/tests/orchestrator/test_migrate_skeleton_hash.py:162", "shortDescription": {"text": "Legacy-named symbol `no_backup` in backend/tests/orchestrator/test_migrate_skeleton_hash.py:162"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0115c150e1498595", "name": "Commented-code block (6 lines) in backend/tests/orchestrator/test_agent_matching.py:265", "shortDescription": {"text": "Commented-code block (6 lines) in backend/tests/orchestrator/test_agent_matching.py:265"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3d961dceef4820a7", "name": "Legacy-named symbol `no_backup` in backend/tests/orchestrator/test_migrate.py:190", "shortDescription": {"text": "Legacy-named symbol `no_backup` in backend/tests/orchestrator/test_migrate.py:190"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7724f4013fcde3bf", "name": "Legacy-named symbol `materialize_skeleton_v2` in backend/tests/orchestrator/test_orchestrate.py:985", "shortDescription": {"text": "Legacy-named symbol `materialize_skeleton_v2` in backend/tests/orchestrator/test_orchestrate.py:985"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4f0a63e2d7c361f7", "name": "Legacy-named symbol `is_legacy` in backend/tests/orchestrator/test_skeleton_hash.py:89", "shortDescription": {"text": "Legacy-named symbol `is_legacy` in backend/tests/orchestrator/test_skeleton_hash.py:89"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0626fe14cc3f7107", "name": "Legacy-named symbol `no_backup` in backend/tests/skills/test_ha_deepinit_augment_plan.py:63", "shortDescription": {"text": "Legacy-named symbol `no_backup` in backend/tests/skills/test_ha_deepinit_augment_plan.py:63"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d43d9608820523ed", "name": "Legacy-named symbol `test_append_new_today_section_above_old` in backend/tests/skills/test_ha_log_run.py:69", "shortDescription": {"text": "Legacy-named symbol `test_append_new_today_section_above_old` in backend/tests/skills/test_ha_log_run.py:69"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6ca87d3975f55544", "name": "Legacy-named symbol `is_legacy` in backend/tests/skills/test_ha_verify_integrity_gate.py:140", "shortDescription": {"text": "Legacy-named symbol `is_legacy` in backend/tests/skills/test_ha_verify_integrity_gate.py:140"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f43add73f6868f4b", "name": "Legacy-named symbol `is_legacy` in backend/tests/skills/test_ha_review_record_gate.py:81", "shortDescription": {"text": "Legacy-named symbol `is_legacy` in backend/tests/skills/test_ha_review_record_gate.py:81"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-30036a4770da746a", "name": "Commented-code block (5 lines) in backend/src/orchestrator/consistency.py:94", "shortDescription": {"text": "Commented-code block (5 lines) in backend/src/orchestrator/consistency.py:94"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-73222e7c34d155c6", "name": "Commented-code block (7 lines) in backend/src/orchestrator/capabilities.py:14", "shortDescription": {"text": "Commented-code block (7 lines) in backend/src/orchestrator/capabilities.py:14"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-45556540ba878a14", "name": "Legacy-named symbol `materialize_skeleton_v2` in backend/src/orchestrator/pipeline_runner.py:104", "shortDescription": {"text": "Legacy-named symbol `materialize_skeleton_v2` in backend/src/orchestrator/pipeline_runner.py:104"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b7187a487d1c9feb", "name": "Commented-code block (5 lines) in backend/src/orchestrator/context.py:208", "shortDescription": {"text": "Commented-code block (5 lines) in backend/src/orchestrator/context.py:208"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b2e0c612bd70e3b5", "name": "Commented-code block (5 lines) in backend/src/orchestrator/profile_loader.py:411", "shortDescription": {"text": "Commented-code block (5 lines) in backend/src/orchestrator/profile_loader.py:411"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f443d477d81c30c0", "name": "Legacy-named symbol `no_backup` in backend/src/orchestrator/skeleton_stale.py:154", "shortDescription": {"text": "Legacy-named symbol `no_backup` in backend/src/orchestrator/skeleton_stale.py:154"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cbce5fb0546c4fa4", "name": "Legacy-named symbol `is_legacy` in backend/src/orchestrator/skeleton_hash.py:53", "shortDescription": {"text": "Legacy-named symbol `is_legacy` in backend/src/orchestrator/skeleton_hash.py:53"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-04e068a5fd26cfdd", "name": "Legacy-named symbol `materialize_skeleton_v2` in backend/src/orchestrator/orchestrate.py:404", "shortDescription": {"text": "Legacy-named symbol `materialize_skeleton_v2` in backend/src/orchestrator/orchestrate.py:404"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a0dc450ced150680", "name": "Commented-code block (5 lines) in backend/src/orchestrator/consistency_checker.py:21", "shortDescription": {"text": "Commented-code block (5 lines) in backend/src/orchestrator/consistency_checker.py:21"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-da9bdbcdc35c6ace", "name": "Legacy-named symbol `add_backup` in backend/src/orchestrator/plan_manager.py:630", "shortDescription": {"text": "Legacy-named symbol `add_backup` in backend/src/orchestrator/plan_manager.py:630"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-51a538051529f33a", "name": "Commented-code block (5 lines) in backend/src/orchestrator/plan_manager.py:46", "shortDescription": {"text": "Commented-code block (5 lines) in backend/src/orchestrator/plan_manager.py:46"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbackend/src/dashboard/server.py:dispatch, backend/src/dashboard/server.py:dispatch\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49c98f7cedd9c977", "name": "Near-duplicate function bodies in 4 places", "shortDescription": {"text": "Near-duplicate function bodies in 4 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbackend/src/orchestrator/providers/gemini_cli.py:execute, backend/src/orchestrator/providers/claude_cli.py:execute, backend/src/orchestrator/providers/base.py:execute, backend/src/orchestrator/providers/gemini_api.py:execute\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fa9a9d04705fb28c", "name": "FastAPI POST `wipe` without auth dependency \u2014 scripts/gate_benchmark.py:176", "shortDescription": {"text": "FastAPI POST `wipe` without auth dependency \u2014 scripts/gate_benchmark.py:176"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2a4153fee93066ee", "name": "FastAPI POST `send_command` without auth dependency \u2014 backend/src/dashboard/routes/command.py:41", "shortDescription": {"text": "FastAPI POST `send_command` without auth dependency \u2014 backend/src/dashboard/routes/command.py:41"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a4f9585370a026c1", "name": "Unused endpoint: POST /admin/wipe", "shortDescription": {"text": "Unused endpoint: POST /admin/wipe"}, "fullDescription": {"text": "`scripts/gate_benchmark.py` declares `POST /admin/wipe` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c1e1ee09590b0a49", "name": "Unused endpoint: GET /projects", "shortDescription": {"text": "Unused endpoint: GET /projects"}, "fullDescription": {"text": "`scripts/gate_benchmark.py` declares `GET /projects` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a009b1a56794f45", "name": "Unused endpoint: POST /", "shortDescription": {"text": "Unused endpoint: POST /"}, "fullDescription": {"text": "`backend/src/dashboard/routes/command.py` declares `POST /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`backend/src/dashboard/routes/tasks.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b2347b89b889964e", "name": "Unused endpoint: GET /{task_id}", "shortDescription": {"text": "Unused endpoint: GET /{task_id}"}, "fullDescription": {"text": "`backend/src/dashboard/routes/tasks.py` declares `GET /{task_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be653b32b59ae96c", "name": "Unused endpoint: GET /{agent_id}", "shortDescription": {"text": "Unused endpoint: GET /{agent_id}"}, "fullDescription": {"text": "`backend/src/dashboard/routes/agents.py` declares `GET /{agent_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e1b7bee247ffc801", "name": "Unused endpoint: GET /summary", "shortDescription": {"text": "Unused endpoint: GET /summary"}, "fullDescription": {"text": "`backend/src/dashboard/routes/stats.py` declares `GET /summary` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/17938"}, "properties": {"repository": "reasonableplan/harnessai", "repoUrl": "https://github.com/reasonableplan/harnessai", "branch": "main"}, "results": [{"ruleId": "scanner-7689d01be8e7df91", "level": "note", "message": {"text": "Possibly dead Python function: check_auth"}, "properties": {"repobilityId": "acdbb0afecb1f3f6", "scanner": "scanner-primary", "fingerprint": "7689d01be8e7df91", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/dashboard/auth.py:13"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-307ee839a7ea1172", "level": "note", "message": {"text": "Possibly dead Python function: connect"}, "properties": {"repobilityId": "8c42b096385506c9", "scanner": "scanner-primary", "fingerprint": "307ee839a7ea1172", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/dashboard/websocket_manager.py:80"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-60146976ca849bb9", "level": "note", "message": {"text": "Possibly dead Python function: preview_skeleton_stale"}, "properties": {"repobilityId": "88a2dbcbc5d0fa9b", "scanner": "scanner-primary", "fingerprint": "60146976ca849bb9", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/orchestrator/skeleton_stale.py:107"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aaca3befe89bb28f", "level": "note", "message": {"text": "Possibly dead Python function: mark_skeleton_stale"}, "properties": {"repobilityId": "4916a70f32ce5a04", "scanner": "scanner-primary", "fingerprint": "aaca3befe89bb28f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/orchestrator/skeleton_stale.py:148"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-714c31ca9f474ae6", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "properties": {"repobilityId": "d94b18e1e1d30395", "scanner": "scanner-primary", "fingerprint": "714c31ca9f474ae6", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/Dockerfile"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-714c31ca9f474ae6", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "properties": {"repobilityId": "751728920ea97a95", "scanner": "scanner-primary", "fingerprint": "714c31ca9f474ae6", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/Dockerfile"}, "region": {"startLine": 11}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-d4f99a08805e6a47", "level": "error", "message": {"text": "Possible secret in scripts/gate_benchmark.py"}, "properties": {"repobilityId": "d66a6b18e21b433d", "scanner": "scanner-primary", "fingerprint": "d4f99a08805e6a47", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/gate_benchmark.py"}, "region": {"startLine": 132}}}]}, {"ruleId": "scanner-8d748463132c666a", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in scripts/gate_benchmark.py:141"}, "properties": {"repobilityId": "c15c69e15aeaf526", "scanner": "scanner-primary", "fingerprint": "8d748463132c666a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/gate_benchmark.py"}, "region": {"startLine": 141}}}]}, {"ruleId": "scanner-2aa0033ab01a76cc", "level": "warning", "message": {"text": "Insecure pattern 'subprocess_shell_true' in skills/ha-build/run.py:384"}, "properties": {"repobilityId": "0697afccc7ed0f47", "scanner": "scanner-primary", "fingerprint": "2aa0033ab01a76cc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "subprocess_shell_true"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/ha-build/run.py"}, "region": {"startLine": 384}}}]}, {"ruleId": "scanner-692ab71ff98012fc", "level": "warning", "message": {"text": "Insecure pattern 'subprocess_shell_true' in skills/ha-smoke/run.py:70"}, "properties": {"repobilityId": "d825ac56afa6ad5f", "scanner": "scanner-primary", "fingerprint": "692ab71ff98012fc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "subprocess_shell_true"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/ha-smoke/run.py"}, "region": {"startLine": 70}}}]}, {"ruleId": "scanner-ff7524b61dd45ba9", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in backend/src/orchestrator/security_hooks.py:282"}, "properties": {"repobilityId": "21b22c1c4b5dba9b", "scanner": "scanner-primary", "fingerprint": "ff7524b61dd45ba9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/orchestrator/security_hooks.py"}, "region": {"startLine": 282}}}]}, {"ruleId": "scanner-4178e4c0057373ff", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in backend/src/orchestrator/security_hooks.py:287"}, "properties": {"repobilityId": "535bff9f12b5461f", "scanner": "scanner-primary", "fingerprint": "4178e4c0057373ff", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/orchestrator/security_hooks.py"}, "region": {"startLine": 287}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4f39ee857107df13", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-7e487cb8317c43b6", "level": "note", "message": {"text": "Very large file: backend/tests/orchestrator/test_plan_manager.py (1493 lines)"}, "properties": {"repobilityId": "8ae0b04c0685c040", "scanner": "scanner-primary", "fingerprint": "7e487cb8317c43b6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-7a680c5a41542353", "level": "note", "message": {"text": "Very large file: backend/tests/orchestrator/test_profile_loader.py (2194 lines)"}, "properties": {"repobilityId": "8340f285358a9ad7", "scanner": "scanner-primary", "fingerprint": "7a680c5a41542353", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "772dcc9a7813c132", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "086ba2ef940011fe", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "da7a62628c8b9632", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "66f58617e2a04d3e", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "d0bdbd6c407833bf", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-1cb17c4b674a4094", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/ha-redesign/SKILL.md"}, "properties": {"repobilityId": "a26d41bc9d87ef5f", "scanner": "scanner-primary", "fingerprint": "1cb17c4b674a4094", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/ha-redesign/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fb4ebc725ceead1d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/ha-ship/SKILL.md"}, "properties": {"repobilityId": "110e7490ac477415", "scanner": "scanner-primary", "fingerprint": "fb4ebc725ceead1d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/ha-ship/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9a7dcbfc0380243e", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: skills/ha-review/SKILL.md"}, "properties": {"repobilityId": "726ca81444eb0715", "scanner": "scanner-primary", "fingerprint": "9a7dcbfc0380243e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/ha-review/SKILL.md"}, "region": {"startLine": 91}}}]}, {"ruleId": "scanner-dd56d9a6d50bede6", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/ha-log/SKILL.md"}, "properties": {"repobilityId": "2e21b4f59c69f0c7", "scanner": "scanner-primary", "fingerprint": "dd56d9a6d50bede6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/ha-log/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6566e4a6866fff0b", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: backend/agents/qa/CLAUDE.md"}, "properties": {"repobilityId": "b1e58110534c3325", "scanner": "scanner-primary", "fingerprint": "6566e4a6866fff0b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/agents/qa/CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1d931aa239cabd8c", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: backend/agents/reviewer/CLAUDE.md"}, "properties": {"repobilityId": "caac58ce96177c32", "scanner": "scanner-primary", "fingerprint": "1d931aa239cabd8c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/agents/reviewer/CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-43cf774d26583089", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: backend/agents/mobile_coder_ios/CLAUDE.md"}, "properties": {"repobilityId": "6254e2c9a2eb9d74", "scanner": "scanner-primary", "fingerprint": "43cf774d26583089", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/agents/mobile_coder_ios/CLAUDE.md"}, "region": {"startLine": 86}}}]}, {"ruleId": "scanner-c7650fbffc58ec18", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/gate_benchmark.py:139"}, "properties": {"repobilityId": "b5e86d7c0c9015be", "scanner": "scanner-primary", "fingerprint": "c7650fbffc58ec18", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-041c32e29c400db9", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/benchmark.py:104"}, "properties": {"repobilityId": "fec04856d0865060", "scanner": "scanner-primary", "fingerprint": "041c32e29c400db9", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-10495c38717f1b40", "level": "note", "message": {"text": "Legacy-named symbol `is_legacy` in skills/ha-build/run.py:129"}, "properties": {"repobilityId": "af3a120722cc5898", "scanner": "scanner-primary", "fingerprint": "10495c38717f1b40", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-edc72b258f7797ba", "level": "none", "message": {"text": "Commented-code block (5 lines) in skills/ha-build/run.py:468"}, "properties": {"repobilityId": "510da572ab4c314d", "scanner": "scanner-primary", "fingerprint": "edc72b258f7797ba", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f1964431f0d6f5c7", "level": "note", "message": {"text": "Legacy-named symbol `is_legacy` in skills/ha-redesign/run.py:123"}, "properties": {"repobilityId": "8bc5c1d76707d0ed", "scanner": "scanner-primary", "fingerprint": "f1964431f0d6f5c7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-f125a70a189a00ed", "level": "none", "message": {"text": "Commented-code block (5 lines) in skills/ha-redesign/run.py:310"}, "properties": {"repobilityId": "9271bbc5de854c22", "scanner": "scanner-primary", "fingerprint": "f125a70a189a00ed", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-87a224f88a21f962", "level": "note", "message": {"text": "Legacy-named symbol `is_legacy` in skills/ha-plan/run.py:175"}, "properties": {"repobilityId": "0a40a070c20a23c5", "scanner": "scanner-primary", "fingerprint": "87a224f88a21f962", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-afe74b34c79aa644", "level": "none", "message": {"text": "Commented-code block (5 lines) in skills/ha-plan/run.py:287"}, "properties": {"repobilityId": "463bc78ce1846786", "scanner": "scanner-primary", "fingerprint": "afe74b34c79aa644", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9876c07be050a224", "level": "note", "message": {"text": "Legacy-named symbol `is_legacy` in skills/ha-review/run.py:756"}, "properties": {"repobilityId": "ede7a9bc6cdb3e49", "scanner": "scanner-primary", "fingerprint": "9876c07be050a224", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-7de505fc59f5fad3", "level": "none", "message": {"text": "Commented-code block (5 lines) in skills/ha-review/run.py:106"}, "properties": {"repobilityId": "7874e515f8d0d701", "scanner": "scanner-primary", "fingerprint": "7de505fc59f5fad3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-47d917246f1382eb", "level": "note", "message": {"text": "Legacy-named symbol `is_legacy` in skills/ha-verify/run.py:140"}, "properties": {"repobilityId": "c536e3a77f3188b2", "scanner": "scanner-primary", "fingerprint": "47d917246f1382eb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-ba9e7d6ba1e1033c", "level": "note", "message": {"text": "Legacy-named symbol `no_backup` in skills/ha-deepinit/run.py:145"}, "properties": {"repobilityId": "f20efea842e39175", "scanner": "scanner-primary", "fingerprint": "ba9e7d6ba1e1033c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-9fe2e19bb7324abb", "level": "note", "message": {"text": "Legacy-named symbol `add_backup` in backend/tests/orchestrator/test_plan_manager.py:269"}, "properties": {"repobilityId": "f0b32a41e0c2f605", "scanner": "scanner-primary", "fingerprint": "9fe2e19bb7324abb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-dca0abf6c156e7f5", "level": "note", "message": {"text": "Legacy-named symbol `test_cli_graph_inject_creates_backup` in backend/tests/orchestrator/test_graph_cli.py:109"}, "properties": {"repobilityId": "fd6a25328e4e1056", "scanner": "scanner-primary", "fingerprint": "dca0abf6c156e7f5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-e0adf1172bb45db5", "level": "note", "message": {"text": "Legacy-named symbol `no_backup` in backend/tests/orchestrator/test_migrate_skeleton_hash.py:162"}, "properties": {"repobilityId": "ad7775a1bb99fd67", "scanner": "scanner-primary", "fingerprint": "e0adf1172bb45db5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-0115c150e1498595", "level": "none", "message": {"text": "Commented-code block (6 lines) in backend/tests/orchestrator/test_agent_matching.py:265"}, "properties": {"repobilityId": "e18bb7e24bfcfd3e", "scanner": "scanner-primary", "fingerprint": "0115c150e1498595", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3d961dceef4820a7", "level": "note", "message": {"text": "Legacy-named symbol `no_backup` in backend/tests/orchestrator/test_migrate.py:190"}, "properties": {"repobilityId": "334512e1dc47419d", "scanner": "scanner-primary", "fingerprint": "3d961dceef4820a7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-7724f4013fcde3bf", "level": "note", "message": {"text": "Legacy-named symbol `materialize_skeleton_v2` in backend/tests/orchestrator/test_orchestrate.py:985"}, "properties": {"repobilityId": "ffbba13bdd277adb", "scanner": "scanner-primary", "fingerprint": "7724f4013fcde3bf", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-4f0a63e2d7c361f7", "level": "note", "message": {"text": "Legacy-named symbol `is_legacy` in backend/tests/orchestrator/test_skeleton_hash.py:89"}, "properties": {"repobilityId": "40b5974e90064edb", "scanner": "scanner-primary", "fingerprint": "4f0a63e2d7c361f7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-0626fe14cc3f7107", "level": "note", "message": {"text": "Legacy-named symbol `no_backup` in backend/tests/skills/test_ha_deepinit_augment_plan.py:63"}, "properties": {"repobilityId": "564c5a3334df0088", "scanner": "scanner-primary", "fingerprint": "0626fe14cc3f7107", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-d43d9608820523ed", "level": "note", "message": {"text": "Legacy-named symbol `test_append_new_today_section_above_old` in backend/tests/skills/test_ha_log_run.py:69"}, "properties": {"repobilityId": "a912a8943c30b0b6", "scanner": "scanner-primary", "fingerprint": "d43d9608820523ed", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-6ca87d3975f55544", "level": "note", "message": {"text": "Legacy-named symbol `is_legacy` in backend/tests/skills/test_ha_verify_integrity_gate.py:140"}, "properties": {"repobilityId": "0685604a24088a04", "scanner": "scanner-primary", "fingerprint": "6ca87d3975f55544", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-f43add73f6868f4b", "level": "note", "message": {"text": "Legacy-named symbol `is_legacy` in backend/tests/skills/test_ha_review_record_gate.py:81"}, "properties": {"repobilityId": "ffe9a98b66f13b77", "scanner": "scanner-primary", "fingerprint": "f43add73f6868f4b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-30036a4770da746a", "level": "none", "message": {"text": "Commented-code block (5 lines) in backend/src/orchestrator/consistency.py:94"}, "properties": {"repobilityId": "36db50025416ce64", "scanner": "scanner-primary", "fingerprint": "30036a4770da746a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-73222e7c34d155c6", "level": "none", "message": {"text": "Commented-code block (7 lines) in backend/src/orchestrator/capabilities.py:14"}, "properties": {"repobilityId": "ab7f965802682223", "scanner": "scanner-primary", "fingerprint": "73222e7c34d155c6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-45556540ba878a14", "level": "note", "message": {"text": "Legacy-named symbol `materialize_skeleton_v2` in backend/src/orchestrator/pipeline_runner.py:104"}, "properties": {"repobilityId": "4d250fdffeb668cc", "scanner": "scanner-primary", "fingerprint": "45556540ba878a14", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-b7187a487d1c9feb", "level": "none", "message": {"text": "Commented-code block (5 lines) in backend/src/orchestrator/context.py:208"}, "properties": {"repobilityId": "c1790e7dc62bf359", "scanner": "scanner-primary", "fingerprint": "b7187a487d1c9feb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b2e0c612bd70e3b5", "level": "none", "message": {"text": "Commented-code block (5 lines) in backend/src/orchestrator/profile_loader.py:411"}, "properties": {"repobilityId": "61b4ac044930aaa8", "scanner": "scanner-primary", "fingerprint": "b2e0c612bd70e3b5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f443d477d81c30c0", "level": "note", "message": {"text": "Legacy-named symbol `no_backup` in backend/src/orchestrator/skeleton_stale.py:154"}, "properties": {"repobilityId": "1693cc31b69ebb77", "scanner": "scanner-primary", "fingerprint": "f443d477d81c30c0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-cbce5fb0546c4fa4", "level": "note", "message": {"text": "Legacy-named symbol `is_legacy` in backend/src/orchestrator/skeleton_hash.py:53"}, "properties": {"repobilityId": "dadecfd4f5cf5181", "scanner": "scanner-primary", "fingerprint": "cbce5fb0546c4fa4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-04e068a5fd26cfdd", "level": "note", "message": {"text": "Legacy-named symbol `materialize_skeleton_v2` in backend/src/orchestrator/orchestrate.py:404"}, "properties": {"repobilityId": "de2d81bf9ea7f29c", "scanner": "scanner-primary", "fingerprint": "04e068a5fd26cfdd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-a0dc450ced150680", "level": "none", "message": {"text": "Commented-code block (5 lines) in backend/src/orchestrator/consistency_checker.py:21"}, "properties": {"repobilityId": "448da14fae194cb2", "scanner": "scanner-primary", "fingerprint": "a0dc450ced150680", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-da9bdbcdc35c6ace", "level": "note", "message": {"text": "Legacy-named symbol `add_backup` in backend/src/orchestrator/plan_manager.py:630"}, "properties": {"repobilityId": "5a91ae9aa83857d5", "scanner": "scanner-primary", "fingerprint": "da9bdbcdc35c6ace", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-51a538051529f33a", "level": "none", "message": {"text": "Commented-code block (5 lines) in backend/src/orchestrator/plan_manager.py:46"}, "properties": {"repobilityId": "370bbbc27dedba3f", "scanner": "scanner-primary", "fingerprint": "51a538051529f33a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "34131949f9fa1557", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "5c66e3151f5d8aaf", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "0aafd386ae93d34e", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-fa9a9d04705fb28c", "level": "error", "message": {"text": "FastAPI POST `wipe` without auth dependency \u2014 scripts/gate_benchmark.py:176"}, "properties": {"repobilityId": "70dedb20d662ffdd", "scanner": "scanner-primary", "fingerprint": "fa9a9d04705fb28c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/gate_benchmark.py"}, "region": {"startLine": 176}}}]}, {"ruleId": "scanner-2a4153fee93066ee", "level": "error", "message": {"text": "FastAPI POST `send_command` without auth dependency \u2014 backend/src/dashboard/routes/command.py:41"}, "properties": {"repobilityId": "d76cdbbec34eae6a", "scanner": "scanner-primary", "fingerprint": "2a4153fee93066ee", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/dashboard/routes/command.py"}, "region": {"startLine": 41}}}]}, {"ruleId": "scanner-a4f9585370a026c1", "level": "note", "message": {"text": "Unused endpoint: POST /admin/wipe"}, "properties": {"repobilityId": "e19d554c03de24dc", "scanner": "scanner-primary", "fingerprint": "a4f9585370a026c1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c1e1ee09590b0a49", "level": "note", "message": {"text": "Unused endpoint: GET /projects"}, "properties": {"repobilityId": "de5d9e3d21d03004", "scanner": "scanner-primary", "fingerprint": "c1e1ee09590b0a49", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7a009b1a56794f45", "level": "note", "message": {"text": "Unused endpoint: POST /"}, "properties": {"repobilityId": "123775e249435e25", "scanner": "scanner-primary", "fingerprint": "7a009b1a56794f45", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "91a352463daea865", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b2347b89b889964e", "level": "note", "message": {"text": "Unused endpoint: GET /{task_id}"}, "properties": {"repobilityId": "01da6b83c3d9052e", "scanner": "scanner-primary", "fingerprint": "b2347b89b889964e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-be653b32b59ae96c", "level": "note", "message": {"text": "Unused endpoint: GET /{agent_id}"}, "properties": {"repobilityId": "8c2b483f6743d2cd", "scanner": "scanner-primary", "fingerprint": "be653b32b59ae96c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e1b7bee247ffc801", "level": "note", "message": {"text": "Unused endpoint: GET /summary"}, "properties": {"repobilityId": "ec7536ea39d49ed6", "scanner": "scanner-primary", "fingerprint": "e1b7bee247ffc801", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}