{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-9779588c93b26ba0", "name": "Possibly dead Python function: wrapped_factory", "shortDescription": {"text": "Possibly dead Python function: wrapped_factory"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a18af907be121b4", "name": "Possibly dead Python function: publish", "shortDescription": {"text": "Possibly dead Python function: publish"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dc5c3d4ad72e98d1", "name": "Possibly dead Python function: summarize", "shortDescription": {"text": "Possibly dead Python function: summarize"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8fcad421e749eb0c", "name": "Possibly dead Python function: s_deps", "shortDescription": {"text": "Possibly dead Python function: s_deps"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3a046f9e661918c3", "name": "Possibly dead Python function: s_fixtures", "shortDescription": {"text": "Possibly dead Python function: s_fixtures"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72f5c89a2063d80f", "name": "Possibly dead Python function: s_artifacts", "shortDescription": {"text": "Possibly dead Python function: s_artifacts"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-966b75a10bc08ede", "name": "Possibly dead Python function: s_smoke", "shortDescription": {"text": "Possibly dead Python function: s_smoke"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-db76188508d3d8b9", "name": "Insecure pattern 'subprocess_shell_true' in abench/verify.py:281", "shortDescription": {"text": "Insecure pattern 'subprocess_shell_true' in abench/verify.py:281"}, "fullDescription": {"text": "Found a known-risky pattern (subprocess_shell_true). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 38 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4b26ba2799bf8f6e", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/setup_check.py:68", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/setup_check.py:68"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ec4d6272cd9300a1", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/poke_opencode.py:251", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/poke_opencode.py:251"}, "fullDescription": {"text": "`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cd90fa807892ed25", "name": "Commented-code block (6 lines) in abench_ui/run_session.py:117", "shortDescription": {"text": "Commented-code block (6 lines) in abench_ui/run_session.py:117"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4e45d0e67d70f991", "name": "Commented-code block (6 lines) in abench_ui/server.py:715", "shortDescription": {"text": "Commented-code block (6 lines) in abench_ui/server.py:715"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a659839db578fe02", "name": "Commented-code block (5 lines) in web/src/api/schemaCache.ts:13", "shortDescription": {"text": "Commented-code block (5 lines) in web/src/api/schemaCache.ts:13"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-76de3a8c75ae28dc", "name": "`fetch()` without try/.catch or AbortSignal \u2014 web/src/api/client.ts:27", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 web/src/api/client.ts:27"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f9e9bd098a9c87c7", "name": "Commented-code block (5 lines) in web/src/api/queries.ts:155", "shortDescription": {"text": "Commented-code block (5 lines) in web/src/api/queries.ts:155"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-46bfad9ab94bcbba", "name": "Commented-code block (5 lines) in web/src/components/RunLogToggle.tsx:16", "shortDescription": {"text": "Commented-code block (5 lines) in web/src/components/RunLogToggle.tsx:16"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c107c57256faae1b", "name": "Commented-code block (6 lines) in abench/metrics.py:80", "shortDescription": {"text": "Commented-code block (6 lines) in abench/metrics.py:80"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-863b17777bb292b5", "name": "Commented-code block (5 lines) in abench/prompt.py:4", "shortDescription": {"text": "Commented-code block (5 lines) in abench/prompt.py:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1a035381d487d2a7", "name": "Network/subprocess call without timeout or try/except \u2014 abench/sandbox.py:88", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 abench/sandbox.py:88"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c7a6938e51113f5f", "name": "Commented-code block (5 lines) in abench/opencode_client.py:439", "shortDescription": {"text": "Commented-code block (5 lines) in abench/opencode_client.py:439"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cf5f05d600b7f4d2", "name": "Commented-code block (6 lines) in abench/runner.py:166", "shortDescription": {"text": "Commented-code block (6 lines) in abench/runner.py:166"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d37467d5c1e64843", "name": "Network/subprocess call without timeout or try/except \u2014 abench/fixture.py:85", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 abench/fixture.py:85"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d77cd0e7e32b88c9", "name": "Commented-code block (7 lines) in abench/report.py:93", "shortDescription": {"text": "Commented-code block (7 lines) in abench/report.py:93"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-71f90388947fdbfd", "name": "Network/subprocess call without timeout or try/except \u2014 experiments/picocli-putValue/prepare.py:58", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 experiments/picocli-putValue/prepare.py:58"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-49c98f7cedd9c977", "name": "Near-duplicate function bodies in 4 places", "shortDescription": {"text": "Near-duplicate function bodies in 4 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nabench_ui/ws_client.py:run_task, abench_ui/run_session.py:run_task, abench/opencode_client.py:run_task, abench/opencode_client.py:run_task\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nabench/runner.py:add, abench/runner.py:add\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e243b50d90438d41", "name": "Frontend route `/runs/:name` has no Link/navigate to it \u2014 web/tests/ExperimentResults.batch.test.tsx", "shortDescription": {"text": "Frontend route `/runs/:name` has no Link/navigate to it \u2014 web/tests/ExperimentResults.batch.test.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5f283c3557af9924", "name": "Frontend route `/runs/sessions/:sid` has no Link/navigate to it \u2014 web/tests/ActiveRunsBanner.test.tsx", "shortDescription": {"text": "Frontend route `/runs/sessions/:sid` has no Link/navigate to it \u2014 web/tests/ActiveRunsBanner.test.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6da4d66d833ce751", "name": "Unused endpoint: GET /schema", "shortDescription": {"text": "Unused endpoint: GET /schema"}, "fullDescription": {"text": "`abench_ui/server.py` declares `GET /schema` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ad5e663a54b219ee", "name": "Unused endpoint: GET /experiments", "shortDescription": {"text": "Unused endpoint: GET /experiments"}, "fullDescription": {"text": "`abench_ui/server.py` declares `GET /experiments` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9c09e8e6ba46eb8e", "name": "Unused endpoint: POST /experiments/upload", "shortDescription": {"text": "Unused endpoint: POST /experiments/upload"}, "fullDescription": {"text": "`abench_ui/server.py` declares `POST /experiments/upload` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1cc0ed15d27939a7", "name": "Unused endpoint: GET /experiments/{name}", "shortDescription": {"text": "Unused endpoint: GET /experiments/{name}"}, "fullDescription": {"text": "`abench_ui/server.py` declares `GET /experiments/{name}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d4c2a5ccdb453204", "name": "Unused endpoint: GET /experiments/{name}/verify_command", "shortDescription": {"text": "Unused endpoint: GET /experiments/{name}/verify_command"}, "fullDescription": {"text": "`abench_ui/server.py` declares `GET /experiments/{name}/verify_command` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ae03469bb0da53ec", "name": "Unused endpoint: PUT /experiments/{name}", "shortDescription": {"text": "Unused endpoint: PUT /experiments/{name}"}, "fullDescription": {"text": "`abench_ui/server.py` declares `PUT /experiments/{name}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e4911d6b89bb7a4a", "name": "Unused endpoint: DELETE /experiments/{name}", "shortDescription": {"text": "Unused endpoint: DELETE /experiments/{name}"}, "fullDescription": {"text": "`abench_ui/server.py` declares `DELETE /experiments/{name}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1482b3209347ec6a", "name": "Unused endpoint: GET /runs/{name}/batches", "shortDescription": {"text": "Unused endpoint: GET /runs/{name}/batches"}, "fullDescription": {"text": "`abench_ui/server.py` declares `GET /runs/{name}/batches` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-927b56b950da9939", "name": "Unused endpoint: GET /runs/{name}", "shortDescription": {"text": "Unused endpoint: GET /runs/{name}"}, "fullDescription": {"text": "`abench_ui/server.py` declares `GET /runs/{name}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f96fc374d61bea09", "name": "Unused endpoint: GET /runs/{name}/summary", "shortDescription": {"text": "Unused endpoint: GET /runs/{name}/summary"}, "fullDescription": {"text": "`abench_ui/server.py` declares `GET /runs/{name}/summary` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a788e6b4e15cab00", "name": "Unused endpoint: GET /runs/{name}/{condition}/{rep}/metrics", "shortDescription": {"text": "Unused endpoint: GET /runs/{name}/{condition}/{rep}/metrics"}, "fullDescription": {"text": "`abench_ui/server.py` declares `GET /runs/{name}/{condition}/{rep}/metrics` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3f71c665fea71e4d", "name": "Unused endpoint: GET /runs/{name}/{condition}/{rep}/trace", "shortDescription": {"text": "Unused endpoint: GET /runs/{name}/{condition}/{rep}/trace"}, "fullDescription": {"text": "`abench_ui/server.py` declares `GET /runs/{name}/{condition}/{rep}/trace` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-634d02c646c2d973", "name": "Unused endpoint: GET /runs/{name}/{condition}/{rep}/safe_trace", "shortDescription": {"text": "Unused endpoint: GET /runs/{name}/{condition}/{rep}/safe_trace"}, "fullDescription": {"text": "`abench_ui/server.py` declares `GET /runs/{name}/{condition}/{rep}/safe_trace` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dc501d90f90a2afa", "name": "Unused endpoint: GET /runs/{name}/safe_traces", "shortDescription": {"text": "Unused endpoint: GET /runs/{name}/safe_traces"}, "fullDescription": {"text": "`abench_ui/server.py` declares `GET /runs/{name}/safe_traces` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1a3daa8e0d932ca4", "name": "Unused endpoint: GET /runs/{name}/{condition}/{rep}/patch", "shortDescription": {"text": "Unused endpoint: GET /runs/{name}/{condition}/{rep}/patch"}, "fullDescription": {"text": "`abench_ui/server.py` declares `GET /runs/{name}/{condition}/{rep}/patch` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-74caab7bfbfa01a8", "name": "Unused endpoint: GET /runs/{name}/{condition}/{rep}/events", "shortDescription": {"text": "Unused endpoint: GET /runs/{name}/{condition}/{rep}/events"}, "fullDescription": {"text": "`abench_ui/server.py` declares `GET /runs/{name}/{condition}/{rep}/events` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c11442982fd59230", "name": "Unused endpoint: GET /runs/{name}/{condition}/{rep}/verify_log", "shortDescription": {"text": "Unused endpoint: GET /runs/{name}/{condition}/{rep}/verify_log"}, "fullDescription": {"text": "`abench_ui/server.py` declares `GET /runs/{name}/{condition}/{rep}/verify_log` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f6d813c64f6a7acc", "name": "Unused endpoint: GET /runs/{name}/{condition}/{rep}/run_log", "shortDescription": {"text": "Unused endpoint: GET /runs/{name}/{condition}/{rep}/run_log"}, "fullDescription": {"text": "`abench_ui/server.py` declares `GET /runs/{name}/{condition}/{rep}/run_log` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1f85b99b1d9e09f4", "name": "Unused endpoint: GET /runs/{name}/{condition}/{rep}/debug_log", "shortDescription": {"text": "Unused endpoint: GET /runs/{name}/{condition}/{rep}/debug_log"}, "fullDescription": {"text": "`abench_ui/server.py` declares `GET /runs/{name}/{condition}/{rep}/debug_log` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8cee723ee7e07778", "name": "Unused endpoint: POST /runs/{name}/recompute", "shortDescription": {"text": "Unused endpoint: POST /runs/{name}/recompute"}, "fullDescription": {"text": "`abench_ui/server.py` declares `POST /runs/{name}/recompute` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-62d7fe64e42826f6", "name": "Unused endpoint: GET /runs/{name}/{condition}/{rep}/method_comparison", "shortDescription": {"text": "Unused endpoint: GET /runs/{name}/{condition}/{rep}/method_comparison"}, "fullDescription": {"text": "`abench_ui/server.py` declares `GET /runs/{name}/{condition}/{rep}/method_comparison` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c00eee04b167785e", "name": "Unused endpoint: PATCH /runs/{name}/{condition}/{rep}", "shortDescription": {"text": "Unused endpoint: PATCH /runs/{name}/{condition}/{rep}"}, "fullDescription": {"text": "`abench_ui/server.py` declares `PATCH /runs/{name}/{condition}/{rep}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5f31bd826d8a5f49", "name": "Unused endpoint: POST /validate/model", "shortDescription": {"text": "Unused endpoint: POST /validate/model"}, "fullDescription": {"text": "`abench_ui/server.py` declares `POST /validate/model` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7222c03876f2272f", "name": "Unused endpoint: POST /validate/reachability", "shortDescription": {"text": "Unused endpoint: POST /validate/reachability"}, "fullDescription": {"text": "`abench_ui/server.py` declares `POST /validate/reachability` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2ab9bf5db6820af4", "name": "Unused endpoint: GET /models", "shortDescription": {"text": "Unused endpoint: GET /models"}, "fullDescription": {"text": "`abench_ui/server.py` declares `GET /models` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e21cf4ee09f7c6a9", "name": "Unused endpoint: GET /providers", "shortDescription": {"text": "Unused endpoint: GET /providers"}, "fullDescription": {"text": "`abench_ui/server.py` declares `GET /providers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8dbb2b7135a0611c", "name": "Unused endpoint: POST /providers/{provider}/credentials", "shortDescription": {"text": "Unused endpoint: POST /providers/{provider}/credentials"}, "fullDescription": {"text": "`abench_ui/server.py` declares `POST /providers/{provider}/credentials` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9daeb7b1a43e9733", "name": "Unused endpoint: POST /runs", "shortDescription": {"text": "Unused endpoint: POST /runs"}, "fullDescription": {"text": "`abench_ui/server.py` declares `POST /runs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b15d518d538de57d", "name": "Unused endpoint: GET /sessions", "shortDescription": {"text": "Unused endpoint: GET /sessions"}, "fullDescription": {"text": "`abench_ui/server.py` declares `GET /sessions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-77e497414a27bc4a", "name": "Unused endpoint: GET /sessions/{sid}", "shortDescription": {"text": "Unused endpoint: GET /sessions/{sid}"}, "fullDescription": {"text": "`abench_ui/server.py` declares `GET /sessions/{sid}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-228bbd21de47eef2", "name": "Unused endpoint: DELETE /sessions/{sid}", "shortDescription": {"text": "Unused endpoint: DELETE /sessions/{sid}"}, "fullDescription": {"text": "`abench_ui/server.py` declares `DELETE /sessions/{sid}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aee9168e964a3822", "name": "Unused endpoint: POST /verify", "shortDescription": {"text": "Unused endpoint: POST /verify"}, "fullDescription": {"text": "`abench_ui/server.py` declares `POST /verify` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ebb04ff6fc02e636", "name": "Unused endpoint: GET /verify/{verify_id}", "shortDescription": {"text": "Unused endpoint: GET /verify/{verify_id}"}, "fullDescription": {"text": "`abench_ui/server.py` declares `GET /verify/{verify_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`abench_ui/server.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7704fa4b33201b51", "name": "Unused endpoint: ANY /{full_path:path}", "shortDescription": {"text": "Unused endpoint: ANY /{full_path:path}"}, "fullDescription": {"text": "`abench_ui/server.py` declares `ANY /{full_path:path}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/19073"}, "properties": {"repository": "sckwokyboom/Agentic-Bench", "repoUrl": "https://github.com/sckwokyboom/Agentic-Bench", "branch": "main"}, "results": [{"ruleId": "scanner-9779588c93b26ba0", "level": "note", "message": {"text": "Possibly dead Python function: wrapped_factory"}, "properties": {"repobilityId": "771f8110bf81c1d9", "scanner": "scanner-primary", "fingerprint": "9779588c93b26ba0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "abench_ui/run_session.py:242"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7a18af907be121b4", "level": "note", "message": {"text": "Possibly dead Python function: publish"}, "properties": {"repobilityId": "5b17f293eda90703", "scanner": "scanner-primary", "fingerprint": "7a18af907be121b4", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "abench_ui/server.py:495"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dc5c3d4ad72e98d1", "level": "note", "message": {"text": "Possibly dead Python function: summarize"}, "properties": {"repobilityId": "2f031b6e55dee53f", "scanner": "scanner-primary", "fingerprint": "dc5c3d4ad72e98d1", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "abench/report.py:64"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8fcad421e749eb0c", "level": "note", "message": {"text": "Possibly dead Python function: s_deps"}, "properties": {"repobilityId": "002b07f93b7f9a05", "scanner": "scanner-primary", "fingerprint": "8fcad421e749eb0c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "experiments/picocli-putValue/prepare.py:61"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3a046f9e661918c3", "level": "note", "message": {"text": "Possibly dead Python function: s_fixtures"}, "properties": {"repobilityId": "9ec94b2e5954482c", "scanner": "scanner-primary", "fingerprint": "3a046f9e661918c3", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "experiments/picocli-putValue/prepare.py:75"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-72f5c89a2063d80f", "level": "note", "message": {"text": "Possibly dead Python function: s_artifacts"}, "properties": {"repobilityId": "9fda87cd46520db9", "scanner": "scanner-primary", "fingerprint": "72f5c89a2063d80f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "experiments/picocli-putValue/prepare.py:96"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-966b75a10bc08ede", "level": "note", "message": {"text": "Possibly dead Python function: s_smoke"}, "properties": {"repobilityId": "2dc79ad9ba1b8aac", "scanner": "scanner-primary", "fingerprint": "966b75a10bc08ede", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "experiments/picocli-putValue/prepare.py:133"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-db76188508d3d8b9", "level": "warning", "message": {"text": "Insecure pattern 'subprocess_shell_true' in abench/verify.py:281"}, "properties": {"repobilityId": "919b582423aed8a9", "scanner": "scanner-primary", "fingerprint": "db76188508d3d8b9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "subprocess_shell_true"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "abench/verify.py"}, "region": {"startLine": 281}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "e7f218e4b049c5ca", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "5932ff524ce29b59", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "a61c739c3a68c562", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "0ea0c7779d58324c", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "24a77d5f163d96d2", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "f3741ab9fbb17a6e", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-4b26ba2799bf8f6e", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/setup_check.py:68"}, "properties": {"repobilityId": "643878cbf78722b6", "scanner": "scanner-primary", "fingerprint": "4b26ba2799bf8f6e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-ec4d6272cd9300a1", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/poke_opencode.py:251"}, "properties": {"repobilityId": "e0d2ac13be3f492d", "scanner": "scanner-primary", "fingerprint": "ec4d6272cd9300a1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-cd90fa807892ed25", "level": "none", "message": {"text": "Commented-code block (6 lines) in abench_ui/run_session.py:117"}, "properties": {"repobilityId": "c211822205199987", "scanner": "scanner-primary", "fingerprint": "cd90fa807892ed25", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4e45d0e67d70f991", "level": "none", "message": {"text": "Commented-code block (6 lines) in abench_ui/server.py:715"}, "properties": {"repobilityId": "666641497d39f98c", "scanner": "scanner-primary", "fingerprint": "4e45d0e67d70f991", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a659839db578fe02", "level": "none", "message": {"text": "Commented-code block (5 lines) in web/src/api/schemaCache.ts:13"}, "properties": {"repobilityId": "d2613d7305fb5682", "scanner": "scanner-primary", "fingerprint": "a659839db578fe02", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-76de3a8c75ae28dc", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 web/src/api/client.ts:27"}, "properties": {"repobilityId": "99112b11310dfb7b", "scanner": "scanner-primary", "fingerprint": "76de3a8c75ae28dc", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-f9e9bd098a9c87c7", "level": "none", "message": {"text": "Commented-code block (5 lines) in web/src/api/queries.ts:155"}, "properties": {"repobilityId": "55016e7978409555", "scanner": "scanner-primary", "fingerprint": "f9e9bd098a9c87c7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-46bfad9ab94bcbba", "level": "none", "message": {"text": "Commented-code block (5 lines) in web/src/components/RunLogToggle.tsx:16"}, "properties": {"repobilityId": "393efe8357c08cce", "scanner": "scanner-primary", "fingerprint": "46bfad9ab94bcbba", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c107c57256faae1b", "level": "none", "message": {"text": "Commented-code block (6 lines) in abench/metrics.py:80"}, "properties": {"repobilityId": "4f13ce54c0e7b9fc", "scanner": "scanner-primary", "fingerprint": "c107c57256faae1b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-863b17777bb292b5", "level": "none", "message": {"text": "Commented-code block (5 lines) in abench/prompt.py:4"}, "properties": {"repobilityId": "e6c7710e474f40f2", "scanner": "scanner-primary", "fingerprint": "863b17777bb292b5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1a035381d487d2a7", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 abench/sandbox.py:88"}, "properties": {"repobilityId": "962f478db1a432ae", "scanner": "scanner-primary", "fingerprint": "1a035381d487d2a7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-c7a6938e51113f5f", "level": "none", "message": {"text": "Commented-code block (5 lines) in abench/opencode_client.py:439"}, "properties": {"repobilityId": "b6ff218d6a53629e", "scanner": "scanner-primary", "fingerprint": "c7a6938e51113f5f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cf5f05d600b7f4d2", "level": "none", "message": {"text": "Commented-code block (6 lines) in abench/runner.py:166"}, "properties": {"repobilityId": "98a155a6fe61a159", "scanner": "scanner-primary", "fingerprint": "cf5f05d600b7f4d2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d37467d5c1e64843", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 abench/fixture.py:85"}, "properties": {"repobilityId": "20c9bdef0d8c4d93", "scanner": "scanner-primary", "fingerprint": "d37467d5c1e64843", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-d77cd0e7e32b88c9", "level": "none", "message": {"text": "Commented-code block (7 lines) in abench/report.py:93"}, "properties": {"repobilityId": "5b3d3b6dabb5fc9b", "scanner": "scanner-primary", "fingerprint": "d77cd0e7e32b88c9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-71f90388947fdbfd", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 experiments/picocli-putValue/prepare.py:58"}, "properties": {"repobilityId": "16a91faf7450e3c6", "scanner": "scanner-primary", "fingerprint": "71f90388947fdbfd", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "e3c1dd00c9e76457", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "1d7b8b11c1232dff", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-e243b50d90438d41", "level": "warning", "message": {"text": "Frontend route `/runs/:name` has no Link/navigate to it \u2014 web/tests/ExperimentResults.batch.test.tsx"}, "properties": {"repobilityId": "b021756c5463f8c6", "scanner": "scanner-primary", "fingerprint": "e243b50d90438d41", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-5f283c3557af9924", "level": "warning", "message": {"text": "Frontend route `/runs/sessions/:sid` has no Link/navigate to it \u2014 web/tests/ActiveRunsBanner.test.tsx"}, "properties": {"repobilityId": "2894d3fc4927f38f", "scanner": "scanner-primary", "fingerprint": "5f283c3557af9924", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-6da4d66d833ce751", "level": "note", "message": {"text": "Unused endpoint: GET /schema"}, "properties": {"repobilityId": "297bc37323014f34", "scanner": "scanner-primary", "fingerprint": "6da4d66d833ce751", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ad5e663a54b219ee", "level": "note", "message": {"text": "Unused endpoint: GET /experiments"}, "properties": {"repobilityId": "dcbf4e86b4b6174f", "scanner": "scanner-primary", "fingerprint": "ad5e663a54b219ee", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9c09e8e6ba46eb8e", "level": "note", "message": {"text": "Unused endpoint: POST /experiments/upload"}, "properties": {"repobilityId": "d15abe5d07ea3596", "scanner": "scanner-primary", "fingerprint": "9c09e8e6ba46eb8e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1cc0ed15d27939a7", "level": "note", "message": {"text": "Unused endpoint: GET /experiments/{name}"}, "properties": {"repobilityId": "24ae27f7615000d3", "scanner": "scanner-primary", "fingerprint": "1cc0ed15d27939a7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d4c2a5ccdb453204", "level": "note", "message": {"text": "Unused endpoint: GET /experiments/{name}/verify_command"}, "properties": {"repobilityId": "5648ad4ac2a15198", "scanner": "scanner-primary", "fingerprint": "d4c2a5ccdb453204", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ae03469bb0da53ec", "level": "note", "message": {"text": "Unused endpoint: PUT /experiments/{name}"}, "properties": {"repobilityId": "ec767b4c5bb2766a", "scanner": "scanner-primary", "fingerprint": "ae03469bb0da53ec", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e4911d6b89bb7a4a", "level": "note", "message": {"text": "Unused endpoint: DELETE /experiments/{name}"}, "properties": {"repobilityId": "461b668d58940101", "scanner": "scanner-primary", "fingerprint": "e4911d6b89bb7a4a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1482b3209347ec6a", "level": "note", "message": {"text": "Unused endpoint: GET /runs/{name}/batches"}, "properties": {"repobilityId": "7fa3b55b039db602", "scanner": "scanner-primary", "fingerprint": "1482b3209347ec6a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-927b56b950da9939", "level": "note", "message": {"text": "Unused endpoint: GET /runs/{name}"}, "properties": {"repobilityId": "88a26b68ff867e52", "scanner": "scanner-primary", "fingerprint": "927b56b950da9939", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f96fc374d61bea09", "level": "note", "message": {"text": "Unused endpoint: GET /runs/{name}/summary"}, "properties": {"repobilityId": "152d65294d797661", "scanner": "scanner-primary", "fingerprint": "f96fc374d61bea09", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a788e6b4e15cab00", "level": "note", "message": {"text": "Unused endpoint: GET /runs/{name}/{condition}/{rep}/metrics"}, "properties": {"repobilityId": "fba0b460e4a64153", "scanner": "scanner-primary", "fingerprint": "a788e6b4e15cab00", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3f71c665fea71e4d", "level": "note", "message": {"text": "Unused endpoint: GET /runs/{name}/{condition}/{rep}/trace"}, "properties": {"repobilityId": "663da6c2b2d48dea", "scanner": "scanner-primary", "fingerprint": "3f71c665fea71e4d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-634d02c646c2d973", "level": "note", "message": {"text": "Unused endpoint: GET /runs/{name}/{condition}/{rep}/safe_trace"}, "properties": {"repobilityId": "fbc6e6553f60173a", "scanner": "scanner-primary", "fingerprint": "634d02c646c2d973", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-dc501d90f90a2afa", "level": "note", "message": {"text": "Unused endpoint: GET /runs/{name}/safe_traces"}, "properties": {"repobilityId": "7700ca997a17f77f", "scanner": "scanner-primary", "fingerprint": "dc501d90f90a2afa", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1a3daa8e0d932ca4", "level": "note", "message": {"text": "Unused endpoint: GET /runs/{name}/{condition}/{rep}/patch"}, "properties": {"repobilityId": "c87b35749f4bf7d1", "scanner": "scanner-primary", "fingerprint": "1a3daa8e0d932ca4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-74caab7bfbfa01a8", "level": "note", "message": {"text": "Unused endpoint: GET /runs/{name}/{condition}/{rep}/events"}, "properties": {"repobilityId": "986d560fb5f6e55a", "scanner": "scanner-primary", "fingerprint": "74caab7bfbfa01a8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c11442982fd59230", "level": "note", "message": {"text": "Unused endpoint: GET /runs/{name}/{condition}/{rep}/verify_log"}, "properties": {"repobilityId": "860f615d878f77e3", "scanner": "scanner-primary", "fingerprint": "c11442982fd59230", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f6d813c64f6a7acc", "level": "note", "message": {"text": "Unused endpoint: GET /runs/{name}/{condition}/{rep}/run_log"}, "properties": {"repobilityId": "cf242043bdace4af", "scanner": "scanner-primary", "fingerprint": "f6d813c64f6a7acc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1f85b99b1d9e09f4", "level": "note", "message": {"text": "Unused endpoint: GET /runs/{name}/{condition}/{rep}/debug_log"}, "properties": {"repobilityId": "4e1de46475099c3e", "scanner": "scanner-primary", "fingerprint": "1f85b99b1d9e09f4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8cee723ee7e07778", "level": "note", "message": {"text": "Unused endpoint: POST /runs/{name}/recompute"}, "properties": {"repobilityId": "933166e0fbe9d953", "scanner": "scanner-primary", "fingerprint": "8cee723ee7e07778", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-62d7fe64e42826f6", "level": "note", "message": {"text": "Unused endpoint: GET /runs/{name}/{condition}/{rep}/method_comparison"}, "properties": {"repobilityId": "0b07f7f9e86e692e", "scanner": "scanner-primary", "fingerprint": "62d7fe64e42826f6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c00eee04b167785e", "level": "note", "message": {"text": "Unused endpoint: PATCH /runs/{name}/{condition}/{rep}"}, "properties": {"repobilityId": "bb0fff1023115853", "scanner": "scanner-primary", "fingerprint": "c00eee04b167785e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5f31bd826d8a5f49", "level": "note", "message": {"text": "Unused endpoint: POST /validate/model"}, "properties": {"repobilityId": "b18f9003b498195c", "scanner": "scanner-primary", "fingerprint": "5f31bd826d8a5f49", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7222c03876f2272f", "level": "note", "message": {"text": "Unused endpoint: POST /validate/reachability"}, "properties": {"repobilityId": "f7f00c3fb0bdae30", "scanner": "scanner-primary", "fingerprint": "7222c03876f2272f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2ab9bf5db6820af4", "level": "note", "message": {"text": "Unused endpoint: GET /models"}, "properties": {"repobilityId": "a3b184f4847091cf", "scanner": "scanner-primary", "fingerprint": "2ab9bf5db6820af4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e21cf4ee09f7c6a9", "level": "note", "message": {"text": "Unused endpoint: GET /providers"}, "properties": {"repobilityId": "e3953ed6a45bb535", "scanner": "scanner-primary", "fingerprint": "e21cf4ee09f7c6a9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8dbb2b7135a0611c", "level": "note", "message": {"text": "Unused endpoint: POST /providers/{provider}/credentials"}, "properties": {"repobilityId": "295a3bcbd8a63130", "scanner": "scanner-primary", "fingerprint": "8dbb2b7135a0611c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9daeb7b1a43e9733", "level": "note", "message": {"text": "Unused endpoint: POST /runs"}, "properties": {"repobilityId": "c6b42a304b59de52", "scanner": "scanner-primary", "fingerprint": "9daeb7b1a43e9733", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b15d518d538de57d", "level": "note", "message": {"text": "Unused endpoint: GET /sessions"}, "properties": {"repobilityId": "ec73d98cdede664c", "scanner": "scanner-primary", "fingerprint": "b15d518d538de57d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-77e497414a27bc4a", "level": "note", "message": {"text": "Unused endpoint: GET /sessions/{sid}"}, "properties": {"repobilityId": "4e097729a1e80f91", "scanner": "scanner-primary", "fingerprint": "77e497414a27bc4a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-228bbd21de47eef2", "level": "note", "message": {"text": "Unused endpoint: DELETE /sessions/{sid}"}, "properties": {"repobilityId": "65936465a54b3a6b", "scanner": "scanner-primary", "fingerprint": "228bbd21de47eef2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-aee9168e964a3822", "level": "note", "message": {"text": "Unused endpoint: POST /verify"}, "properties": {"repobilityId": "b242d1fe9132a871", "scanner": "scanner-primary", "fingerprint": "aee9168e964a3822", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ebb04ff6fc02e636", "level": "note", "message": {"text": "Unused endpoint: GET /verify/{verify_id}"}, "properties": {"repobilityId": "309ad353323a783a", "scanner": "scanner-primary", "fingerprint": "ebb04ff6fc02e636", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "185d67ab8bcfdf2b", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7704fa4b33201b51", "level": "note", "message": {"text": "Unused endpoint: ANY /{full_path:path}"}, "properties": {"repobilityId": "ffa25ccd0f5f6066", "scanner": "scanner-primary", "fingerprint": "7704fa4b33201b51", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}