{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-5deba6f749667069", "name": "Possibly dead Python function: cmd_manifest", "shortDescription": {"text": "Possibly dead Python function: cmd_manifest"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0c029118d3c19676", "name": "Possibly dead Python function: cmd_list_lenses", "shortDescription": {"text": "Possibly dead Python function: cmd_list_lenses"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dd8d7f242404e252", "name": "Possibly dead Python function: cmd_get_lens", "shortDescription": {"text": "Possibly dead Python function: cmd_get_lens"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a3f8c43d267b6fd", "name": "Possibly dead Python function: cmd_get_protocol", "shortDescription": {"text": "Possibly dead Python function: cmd_get_protocol"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3b94f5480feb4677", "name": "Possibly dead Python function: cmd_validate_brief", "shortDescription": {"text": "Possibly dead Python function: cmd_validate_brief"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2e99e6ebf316e54c", "name": "Possibly dead Python function: cmd_validate_evidence", "shortDescription": {"text": "Possibly dead Python function: cmd_validate_evidence"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4703bdc571fb1fb8", "name": "Possibly dead Python function: cmd_validate_manifest", "shortDescription": {"text": "Possibly dead Python function: cmd_validate_manifest"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3e5225ce799250be", "name": "Possibly dead Python function: cmd_source_types", "shortDescription": {"text": "Possibly dead Python function: cmd_source_types"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9dd55d6bd0cd341b", "name": "Possibly dead Python function: cmd_list_source_packs", "shortDescription": {"text": "Possibly dead Python function: cmd_list_source_packs"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8440e5ab29b2156c", "name": "Possibly dead Python function: cmd_source_categories", "shortDescription": {"text": "Possibly dead Python function: cmd_source_categories"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9895084b64063230", "name": "Possibly dead Python function: cmd_source_plan", "shortDescription": {"text": "Possibly dead Python function: cmd_source_plan"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9f13a96911f6fa19", "name": "Possibly dead Python function: cmd_source_coverage", "shortDescription": {"text": "Possibly dead Python function: cmd_source_coverage"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e0ebbf3b48dde50c", "name": "Possibly dead Python function: cmd_start", "shortDescription": {"text": "Possibly dead Python function: cmd_start"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-34818ff323e732e6", "name": "Possibly dead Python function: cmd_score", "shortDescription": {"text": "Possibly dead Python function: cmd_score"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-96c44b7995e5c174", "name": "Possibly dead Python function: cmd_memory_search", "shortDescription": {"text": "Possibly dead Python function: cmd_memory_search"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b214ea7acef88739", "name": "Possibly dead Python function: handle_starttag", "shortDescription": {"text": "Possibly dead Python function: handle_starttag"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5be2e151e857b26f", "name": "Possibly dead Python function: handle_endtag", "shortDescription": {"text": "Possibly dead Python function: handle_endtag"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f9056db378836293", "name": "Possibly dead Python function: handle_data", "shortDescription": {"text": "Possibly dead Python function: handle_data"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-18d38225804fcf27", "name": "Possibly dead Python function: cmd_verify_quotes", "shortDescription": {"text": "Possibly dead Python function: cmd_verify_quotes"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5263a2a0037f9c8b", "name": "Possibly dead Python function: cmd_bench", "shortDescription": {"text": "Possibly dead Python function: cmd_bench"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d9b9157efd82cc96", "name": "Possibly dead Python function: cmd_audit_claims", "shortDescription": {"text": "Possibly dead Python function: cmd_audit_claims"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1ff776e7c0d9bb39", "name": "Possibly dead Python function: cmd_report", "shortDescription": {"text": "Possibly dead Python function: cmd_report"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-47e856954a23fa42", "name": "Possibly dead Python function: cmd_fetch", "shortDescription": {"text": "Possibly dead Python function: cmd_fetch"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3770b874d25bcbf5", "name": "Possibly dead Python function: cmd_mcp_config", "shortDescription": {"text": "Possibly dead Python function: cmd_mcp_config"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-18c6f965f077a764", "name": "Possibly dead Python function: cmd_doctor", "shortDescription": {"text": "Possibly dead Python function: cmd_doctor"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f205356407a2842e", "name": "Possibly dead Python function: log_message", "shortDescription": {"text": "Possibly dead Python function: log_message"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e3bdcb2be3bca85a", "name": "Possibly dead Python function: do_GET", "shortDescription": {"text": "Possibly dead Python function: do_GET"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-75f5b99e58b3a615", "name": "Possibly dead Python function: do_POST", "shortDescription": {"text": "Possibly dead Python function: do_POST"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f608633aedae2e0a", "name": "Stray `console.log` in TS/JS \u2014 deploy/cloudflare-worker/scripts/verify-agent-card.js:181", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 deploy/cloudflare-worker/scripts/verify-agent-card.js:181"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-76eb1a7140a7525f", "name": "Stray `console.log` in TS/JS \u2014 deploy/cloudflare-worker/scripts/stats.js:63", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 deploy/cloudflare-worker/scripts/stats.js:63"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f31b871d026b1ab6", "name": "Stray `console.log` in TS/JS \u2014 deploy/cloudflare-worker/scripts/generate-signing-key.js:37", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 deploy/cloudflare-worker/scripts/generate-signing-key.js:37"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fe17a1b8adea8efb", "name": "Stray `console.log` in TS/JS \u2014 deploy/cloudflare-worker/src/index.js:3326", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 deploy/cloudflare-worker/src/index.js:3326"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d63da3583b14afc0", "name": "Dockerfile runs as root: Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e066691601852931", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e06a39ef9c0c161c", "name": "Insecure pattern 'cors_wildcard' in deploy/cloudflare-worker/src/index.js:438", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in deploy/cloudflare-worker/src/index.js:438"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e091ee8490f3e8a3", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-81af253ec52c5216", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-27924aa79fa4a517", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ce4edaa2bc26045f", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-46c644c6227e4d4a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "pypa/gh-action-pypi-publish@release/v1 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a53bf972e19b52fd", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "pypa/gh-action-pypi-publish@release/v1 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7ffa33751be3d771", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-68df4de72bbfe9d8", "name": "Very large file: deploy/cloudflare-worker/test/worker.test.js (1984 lines)", "shortDescription": {"text": "Very large file: deploy/cloudflare-worker/test/worker.test.js (1984 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e42b42eff6984b41", "name": "Very large file: deploy/cloudflare-worker/src/index.js (4140 lines)", "shortDescription": {"text": "Very large file: deploy/cloudflare-worker/src/index.js (4140 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1a53092d7bd2ef43", "name": "Very large file: src/agenda_intelligence/services.py (1720 lines)", "shortDescription": {"text": "Very large file: src/agenda_intelligence/services.py (1720 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 130 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4fd3f9370e11a61a", "name": "Agent authority lacks a verifier contract: docs/integrations/codex.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: docs/integrations/codex.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bc79631a562a0aad", "name": "Agent authority lacks a verifier contract: docs/integrations/cursor.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: docs/integrations/cursor.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e725d2ab884fbd49", "name": "Multiple root agent instruction files without precedence", "shortDescription": {"text": "Multiple root agent instruction files without precedence"}, "fullDescription": {"text": "The repo has multiple top-level AI-coder instruction files. Without precedence rules, different agents may follow different policies."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3140600c994030ca", "name": "Commented-code block (6 lines) in tests/test_product_shell.py:377", "shortDescription": {"text": "Commented-code block (6 lines) in tests/test_product_shell.py:377"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-29e7e1fe6b4eef8a", "name": "Commented-code block (5 lines) in tests/test_validation.py:236", "shortDescription": {"text": "Commented-code block (5 lines) in tests/test_validation.py:236"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8ec6e66294b60bcd", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/smoke_mcp_config.py:14", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/smoke_mcp_config.py:14"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0b31ddbb60b3bc0e", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/validate.py:155", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/validate.py:155"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1ba2ee6283da37ad", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/validate_public_examples.py:173", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/validate_public_examples.py:173"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-975f287b14123d71", "name": "Commented-code block (5 lines) in deploy/cloudflare-worker/test/worker.test.js:558", "shortDescription": {"text": "Commented-code block (5 lines) in deploy/cloudflare-worker/test/worker.test.js:558"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3f3ae541728146c2", "name": "`fetch()` without try/.catch or AbortSignal \u2014 deploy/cloudflare-worker/scripts/verify-agent-card.js:161", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 deploy/cloudflare-worker/scripts/verify-agent-card.js:161"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7e6fd3555cad30a0", "name": "`fetch()` without try/.catch or AbortSignal \u2014 deploy/cloudflare-worker/scripts/stats.js:52", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 deploy/cloudflare-worker/scripts/stats.js:52"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-006b3bce0b3e95fb", "name": "Commented-code block (8 lines) in deploy/cloudflare-worker/scripts/generate-signing-key.js:7", "shortDescription": {"text": "Commented-code block (8 lines) in deploy/cloudflare-worker/scripts/generate-signing-key.js:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a49dfb9341fcaf74", "name": "Commented-code block (9 lines) in deploy/cloudflare-worker/src/upstream_opensanctions.js:6", "shortDescription": {"text": "Commented-code block (9 lines) in deploy/cloudflare-worker/src/upstream_opensanctions.js:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2d6b996e2a2640f8", "name": "Commented-code block (7 lines) in deploy/cloudflare-worker/src/jws.js:8", "shortDescription": {"text": "Commented-code block (7 lines) in deploy/cloudflare-worker/src/jws.js:8"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-808586f2ff2c8d06", "name": "Commented-code block (5 lines) in deploy/cloudflare-worker/src/index.js:208", "shortDescription": {"text": "Commented-code block (5 lines) in deploy/cloudflare-worker/src/index.js:208"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-29e6bda2708a6a55", "name": "Commented-code block (5 lines) in deploy/cloudflare-worker/src/upstream_watchman.js:3", "shortDescription": {"text": "Commented-code block (5 lines) in deploy/cloudflare-worker/src/upstream_watchman.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9bd92e9375209250", "name": "Commented-code block (5 lines) in src/agenda_intelligence/services.py:555", "shortDescription": {"text": "Commented-code block (5 lines) in src/agenda_intelligence/services.py:555"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b1c8bc29bf013eef", "name": "Network/subprocess call without timeout or try/except \u2014 src/agenda_intelligence/cli.py:282", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 src/agenda_intelligence/cli.py:282"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-992d9688b6b71e08", "name": "Commented-code block (5 lines) in src/agenda_intelligence/mcp_stdio.py:483", "shortDescription": {"text": "Commented-code block (5 lines) in src/agenda_intelligence/mcp_stdio.py:483"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ca49f3a165105523", "name": "Commented-code block (6 lines) in src/agenda_intelligence/a2a_adapter.py:77", "shortDescription": {"text": "Commented-code block (6 lines) in src/agenda_intelligence/a2a_adapter.py:77"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d6a0712b863f938c", "name": "Commented-code block (5 lines) in src/agenda_intelligence/product.py:103", "shortDescription": {"text": "Commented-code block (5 lines) in src/agenda_intelligence/product.py:103"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/22097"}, "properties": {"repository": "vassiliylakhonin/agenda-intelligence-md", "repoUrl": "https://github.com/vassiliylakhonin/agenda-intelligence-md", "branch": "main"}, "results": [{"ruleId": "scanner-5deba6f749667069", "level": "note", "message": {"text": "Possibly dead Python function: cmd_manifest"}, "properties": {"repobilityId": "e15baa1ff37ac693", "scanner": "scanner-primary", "fingerprint": "5deba6f749667069", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agenda_intelligence/cli.py:37"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0c029118d3c19676", "level": "note", "message": {"text": "Possibly dead Python function: cmd_list_lenses"}, "properties": {"repobilityId": "11d7d58480e900eb", "scanner": "scanner-primary", "fingerprint": "0c029118d3c19676", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agenda_intelligence/cli.py:41"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dd8d7f242404e252", "level": "note", "message": {"text": "Possibly dead Python function: cmd_get_lens"}, "properties": {"repobilityId": "9faa47ef4b6e26df", "scanner": "scanner-primary", "fingerprint": "dd8d7f242404e252", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agenda_intelligence/cli.py:49"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7a3f8c43d267b6fd", "level": "note", "message": {"text": "Possibly dead Python function: cmd_get_protocol"}, "properties": {"repobilityId": "5f59cb57bd4a10f8", "scanner": "scanner-primary", "fingerprint": "7a3f8c43d267b6fd", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agenda_intelligence/cli.py:58"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3b94f5480feb4677", "level": "note", "message": {"text": "Possibly dead Python function: cmd_validate_brief"}, "properties": {"repobilityId": "00788628318f1bd4", "scanner": "scanner-primary", "fingerprint": "3b94f5480feb4677", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agenda_intelligence/cli.py:73"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2e99e6ebf316e54c", "level": "note", "message": {"text": "Possibly dead Python function: cmd_validate_evidence"}, "properties": {"repobilityId": "0a649163e8da07d1", "scanner": "scanner-primary", "fingerprint": "2e99e6ebf316e54c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agenda_intelligence/cli.py:77"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4703bdc571fb1fb8", "level": "note", "message": {"text": "Possibly dead Python function: cmd_validate_manifest"}, "properties": {"repobilityId": "6c9d5937648b700f", "scanner": "scanner-primary", "fingerprint": "4703bdc571fb1fb8", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agenda_intelligence/cli.py:81"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3e5225ce799250be", "level": "note", "message": {"text": "Possibly dead Python function: cmd_source_types"}, "properties": {"repobilityId": "71ee12b6fad17d66", "scanner": "scanner-primary", "fingerprint": "3e5225ce799250be", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agenda_intelligence/cli.py:98"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9dd55d6bd0cd341b", "level": "note", "message": {"text": "Possibly dead Python function: cmd_list_source_packs"}, "properties": {"repobilityId": "148200d55a5baf0d", "scanner": "scanner-primary", "fingerprint": "9dd55d6bd0cd341b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agenda_intelligence/cli.py:104"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8440e5ab29b2156c", "level": "note", "message": {"text": "Possibly dead Python function: cmd_source_categories"}, "properties": {"repobilityId": "7dc469586067c295", "scanner": "scanner-primary", "fingerprint": "8440e5ab29b2156c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agenda_intelligence/cli.py:109"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9895084b64063230", "level": "note", "message": {"text": "Possibly dead Python function: cmd_source_plan"}, "properties": {"repobilityId": "fb8ae1c2c4a748f6", "scanner": "scanner-primary", "fingerprint": "9895084b64063230", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agenda_intelligence/cli.py:126"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9f13a96911f6fa19", "level": "note", "message": {"text": "Possibly dead Python function: cmd_source_coverage"}, "properties": {"repobilityId": "9538392f983add52", "scanner": "scanner-primary", "fingerprint": "9f13a96911f6fa19", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agenda_intelligence/cli.py:139"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e0ebbf3b48dde50c", "level": "note", "message": {"text": "Possibly dead Python function: cmd_start"}, "properties": {"repobilityId": "fc872c8259f0135a", "scanner": "scanner-primary", "fingerprint": "e0ebbf3b48dde50c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agenda_intelligence/cli.py:186"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-34818ff323e732e6", "level": "note", "message": {"text": "Possibly dead Python function: cmd_score"}, "properties": {"repobilityId": "0655fecd9a3e04a0", "scanner": "scanner-primary", "fingerprint": "34818ff323e732e6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agenda_intelligence/cli.py:240"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-96c44b7995e5c174", "level": "note", "message": {"text": "Possibly dead Python function: cmd_memory_search"}, "properties": {"repobilityId": "58d80144c206f6c5", "scanner": "scanner-primary", "fingerprint": "96c44b7995e5c174", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agenda_intelligence/cli.py:285"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b214ea7acef88739", "level": "note", "message": {"text": "Possibly dead Python function: handle_starttag"}, "properties": {"repobilityId": "3bf216d149959ebf", "scanner": "scanner-primary", "fingerprint": "b214ea7acef88739", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agenda_intelligence/cli.py:320"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5be2e151e857b26f", "level": "note", "message": {"text": "Possibly dead Python function: handle_endtag"}, "properties": {"repobilityId": "7eb6f3decafc1766", "scanner": "scanner-primary", "fingerprint": "5be2e151e857b26f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agenda_intelligence/cli.py:324"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f9056db378836293", "level": "note", "message": {"text": "Possibly dead Python function: handle_data"}, "properties": {"repobilityId": "3a673a278f4fc1e6", "scanner": "scanner-primary", "fingerprint": "f9056db378836293", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agenda_intelligence/cli.py:328"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-18d38225804fcf27", "level": "note", "message": {"text": "Possibly dead Python function: cmd_verify_quotes"}, "properties": {"repobilityId": "b7cb0e5fb67e197a", "scanner": "scanner-primary", "fingerprint": "18d38225804fcf27", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agenda_intelligence/cli.py:350"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5263a2a0037f9c8b", "level": "note", "message": {"text": "Possibly dead Python function: cmd_bench"}, "properties": {"repobilityId": "a2ea97da7206bf82", "scanner": "scanner-primary", "fingerprint": "5263a2a0037f9c8b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agenda_intelligence/cli.py:473"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d9b9157efd82cc96", "level": "note", "message": {"text": "Possibly dead Python function: cmd_audit_claims"}, "properties": {"repobilityId": "c1fe8905efce7c72", "scanner": "scanner-primary", "fingerprint": "d9b9157efd82cc96", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agenda_intelligence/cli.py:519"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1ff776e7c0d9bb39", "level": "note", "message": {"text": "Possibly dead Python function: cmd_report"}, "properties": {"repobilityId": "e07177dc4040e77f", "scanner": "scanner-primary", "fingerprint": "1ff776e7c0d9bb39", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agenda_intelligence/cli.py:579"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-47e856954a23fa42", "level": "note", "message": {"text": "Possibly dead Python function: cmd_fetch"}, "properties": {"repobilityId": "fedd38ffb5262987", "scanner": "scanner-primary", "fingerprint": "47e856954a23fa42", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agenda_intelligence/cli.py:642"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3770b874d25bcbf5", "level": "note", "message": {"text": "Possibly dead Python function: cmd_mcp_config"}, "properties": {"repobilityId": "a8ac356437843b7c", "scanner": "scanner-primary", "fingerprint": "3770b874d25bcbf5", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agenda_intelligence/cli.py:687"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-18c6f965f077a764", "level": "note", "message": {"text": "Possibly dead Python function: cmd_doctor"}, "properties": {"repobilityId": "9a95a890c390a044", "scanner": "scanner-primary", "fingerprint": "18c6f965f077a764", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agenda_intelligence/cli.py:781"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f205356407a2842e", "level": "note", "message": {"text": "Possibly dead Python function: log_message"}, "properties": {"repobilityId": "965f3150b4af5b2e", "scanner": "scanner-primary", "fingerprint": "f205356407a2842e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agenda_intelligence/http_api.py:158"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e3bdcb2be3bca85a", "level": "note", "message": {"text": "Possibly dead Python function: do_GET"}, "properties": {"repobilityId": "2d943bb45e4f13bd", "scanner": "scanner-primary", "fingerprint": "e3bdcb2be3bca85a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agenda_intelligence/http_api.py:204"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-75f5b99e58b3a615", "level": "note", "message": {"text": "Possibly dead Python function: do_POST"}, "properties": {"repobilityId": "53357410ca9379a9", "scanner": "scanner-primary", "fingerprint": "75f5b99e58b3a615", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agenda_intelligence/http_api.py:208"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f608633aedae2e0a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 deploy/cloudflare-worker/scripts/verify-agent-card.js:181"}, "properties": {"repobilityId": "07d7d3259bf0817c", "scanner": "scanner-primary", "fingerprint": "f608633aedae2e0a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-76eb1a7140a7525f", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 deploy/cloudflare-worker/scripts/stats.js:63"}, "properties": {"repobilityId": "4e41dc29b83d4936", "scanner": "scanner-primary", "fingerprint": "76eb1a7140a7525f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-f31b871d026b1ab6", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 deploy/cloudflare-worker/scripts/generate-signing-key.js:37"}, "properties": {"repobilityId": "beddec38672b8100", "scanner": "scanner-primary", "fingerprint": "f31b871d026b1ab6", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-fe17a1b8adea8efb", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 deploy/cloudflare-worker/src/index.js:3326"}, "properties": {"repobilityId": "fa2a44173f0a0ca0", "scanner": "scanner-primary", "fingerprint": "fe17a1b8adea8efb", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-d63da3583b14afc0", "level": "warning", "message": {"text": "Dockerfile runs as root: Dockerfile"}, "properties": {"repobilityId": "a2ed1bd120e507db", "scanner": "scanner-primary", "fingerprint": "d63da3583b14afc0", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-e066691601852931", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "55eb1d6f098688e6", "scanner": "scanner-primary", "fingerprint": "e066691601852931", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-e06a39ef9c0c161c", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in deploy/cloudflare-worker/src/index.js:438"}, "properties": {"repobilityId": "4f8763d00c9e1e3e", "scanner": "scanner-primary", "fingerprint": "e06a39ef9c0c161c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "deploy/cloudflare-worker/src/index.js"}, "region": {"startLine": 438}}}]}, {"ruleId": "scanner-e091ee8490f3e8a3", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d2ac8a8eb758468d", "scanner": "scanner-primary", "fingerprint": "e091ee8490f3e8a3", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish-mcp-registry.yml"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-81af253ec52c5216", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "1e922b73ba6f0261", "scanner": "scanner-primary", "fingerprint": "81af253ec52c5216", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish-mcp-registry.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "97a9a5de61d82fcd", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1b0add4759a308ec", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-ce4edaa2bc26045f", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "452de1bac02c5ee3", "scanner": "scanner-primary", "fingerprint": "ce4edaa2bc26045f", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/bench.yml"}, "region": {"startLine": 45}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8eb96fb1706184f3", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a53bf972e19b52fd", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "26eca5024249c767", "scanner": "scanner-primary", "fingerprint": "a53bf972e19b52fd", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish.yml"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-7ffa33751be3d771", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "491a3ad29cbaf189", "scanner": "scanner-primary", "fingerprint": "7ffa33751be3d771", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-68df4de72bbfe9d8", "level": "note", "message": {"text": "Very large file: deploy/cloudflare-worker/test/worker.test.js (1984 lines)"}, "properties": {"repobilityId": "2a9e4812889dd42b", "scanner": "scanner-primary", "fingerprint": "68df4de72bbfe9d8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e42b42eff6984b41", "level": "note", "message": {"text": "Very large file: deploy/cloudflare-worker/src/index.js (4140 lines)"}, "properties": {"repobilityId": "3774601348427337", "scanner": "scanner-primary", "fingerprint": "e42b42eff6984b41", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-1a53092d7bd2ef43", "level": "note", "message": {"text": "Very large file: src/agenda_intelligence/services.py (1720 lines)"}, "properties": {"repobilityId": "6df36e24da9135fe", "scanner": "scanner-primary", "fingerprint": "1a53092d7bd2ef43", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "c2ee61fc545b570b", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "9916ff9ecc2d0a6e", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "3d481f80eaee0e05", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "fdfdd009f790dbec", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-4fd3f9370e11a61a", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: docs/integrations/codex.md"}, "properties": {"repobilityId": "8c6ac0bea3cc50e3", "scanner": "scanner-primary", "fingerprint": "4fd3f9370e11a61a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "codex_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/integrations/codex.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bc79631a562a0aad", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: docs/integrations/cursor.md"}, "properties": {"repobilityId": "1b56237c55266f91", "scanner": "scanner-primary", "fingerprint": "bc79631a562a0aad", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agent_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/integrations/cursor.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e725d2ab884fbd49", "level": "note", "message": {"text": "Multiple root agent instruction files without precedence"}, "properties": {"repobilityId": "1953db6c89508d22", "scanner": "scanner-primary", "fingerprint": "e725d2ab884fbd49", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["agent-instructions", "governance"]}}, {"ruleId": "scanner-3140600c994030ca", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/test_product_shell.py:377"}, "properties": {"repobilityId": "c8cfe59b9fabca8f", "scanner": "scanner-primary", "fingerprint": "3140600c994030ca", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-29e7e1fe6b4eef8a", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/test_validation.py:236"}, "properties": {"repobilityId": "2b14e22ecc93a603", "scanner": "scanner-primary", "fingerprint": "29e7e1fe6b4eef8a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8ec6e66294b60bcd", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/smoke_mcp_config.py:14"}, "properties": {"repobilityId": "3465e390b7ad209c", "scanner": "scanner-primary", "fingerprint": "8ec6e66294b60bcd", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-0b31ddbb60b3bc0e", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/validate.py:155"}, "properties": {"repobilityId": "c597e57f2b5c1f3a", "scanner": "scanner-primary", "fingerprint": "0b31ddbb60b3bc0e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-1ba2ee6283da37ad", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/validate_public_examples.py:173"}, "properties": {"repobilityId": "5be23cf12698a197", "scanner": "scanner-primary", "fingerprint": "1ba2ee6283da37ad", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-975f287b14123d71", "level": "none", "message": {"text": "Commented-code block (5 lines) in deploy/cloudflare-worker/test/worker.test.js:558"}, "properties": {"repobilityId": "5c43e861b166249e", "scanner": "scanner-primary", "fingerprint": "975f287b14123d71", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3f3ae541728146c2", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 deploy/cloudflare-worker/scripts/verify-agent-card.js:161"}, "properties": {"repobilityId": "dfe566a9693f755d", "scanner": "scanner-primary", "fingerprint": "3f3ae541728146c2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-7e6fd3555cad30a0", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 deploy/cloudflare-worker/scripts/stats.js:52"}, "properties": {"repobilityId": "91912d5d7a0ae52f", "scanner": "scanner-primary", "fingerprint": "7e6fd3555cad30a0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-006b3bce0b3e95fb", "level": "none", "message": {"text": "Commented-code block (8 lines) in deploy/cloudflare-worker/scripts/generate-signing-key.js:7"}, "properties": {"repobilityId": "03ae4fdcb24ab638", "scanner": "scanner-primary", "fingerprint": "006b3bce0b3e95fb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a49dfb9341fcaf74", "level": "none", "message": {"text": "Commented-code block (9 lines) in deploy/cloudflare-worker/src/upstream_opensanctions.js:6"}, "properties": {"repobilityId": "972c324b31843304", "scanner": "scanner-primary", "fingerprint": "a49dfb9341fcaf74", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2d6b996e2a2640f8", "level": "none", "message": {"text": "Commented-code block (7 lines) in deploy/cloudflare-worker/src/jws.js:8"}, "properties": {"repobilityId": "73aaf02f9e8d242a", "scanner": "scanner-primary", "fingerprint": "2d6b996e2a2640f8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-808586f2ff2c8d06", "level": "none", "message": {"text": "Commented-code block (5 lines) in deploy/cloudflare-worker/src/index.js:208"}, "properties": {"repobilityId": "ce730445c7a4f56d", "scanner": "scanner-primary", "fingerprint": "808586f2ff2c8d06", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-29e6bda2708a6a55", "level": "none", "message": {"text": "Commented-code block (5 lines) in deploy/cloudflare-worker/src/upstream_watchman.js:3"}, "properties": {"repobilityId": "58c33f8360f72db1", "scanner": "scanner-primary", "fingerprint": "29e6bda2708a6a55", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9bd92e9375209250", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/agenda_intelligence/services.py:555"}, "properties": {"repobilityId": "79259e182e66c18b", "scanner": "scanner-primary", "fingerprint": "9bd92e9375209250", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b1c8bc29bf013eef", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 src/agenda_intelligence/cli.py:282"}, "properties": {"repobilityId": "d806fbe7b77a9350", "scanner": "scanner-primary", "fingerprint": "b1c8bc29bf013eef", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-992d9688b6b71e08", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/agenda_intelligence/mcp_stdio.py:483"}, "properties": {"repobilityId": "1a627605a44b2389", "scanner": "scanner-primary", "fingerprint": "992d9688b6b71e08", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ca49f3a165105523", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/agenda_intelligence/a2a_adapter.py:77"}, "properties": {"repobilityId": "222e5494b5036ec0", "scanner": "scanner-primary", "fingerprint": "ca49f3a165105523", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d6a0712b863f938c", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/agenda_intelligence/product.py:103"}, "properties": {"repobilityId": "00d4333fa2f5623c", "scanner": "scanner-primary", "fingerprint": "d6a0712b863f938c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}]}]}