{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-0478b77fac174935", "name": "Stray `console.log` in TS/JS \u2014 packages/deterministic/src/builtin.test.ts:5", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/deterministic/src/builtin.test.ts:5"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-480cb0c716fbc07d", "name": "Stray `console.log` in TS/JS \u2014 packages/deterministic/src/runner.test.ts:99", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/deterministic/src/runner.test.ts:99"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2e7ebf61b02e8651", "name": "React Flow edge with `label=` but no project-wide edge-label CSS override \u2014 packages/viz-server/src/ui.ts:176", "shortDescription": {"text": "React Flow edge with `label=` but no project-wide edge-label CSS override \u2014 packages/viz-server/src/ui.ts:176"}, "fullDescription": {"text": "React Flow edge labels render with a white rectangle behind the text by default, which scatters bright boxes across a dark canvas. Either drop the label, or override `.react-flow__edge-textbg` and `.react-flow__edge-text` in your stylesheet.\n\nWhy: P-H in CHECKLIST.md \u2014 vendor edge labels bleed white through a dark canvas.\nRule id: fq.edge-label.no-bg"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2e575955dafbf1b1", "name": "Privileged port 59 in use", "shortDescription": {"text": "Privileged port 59 in use"}, "fullDescription": {"text": "Port 59 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-14b61c3d97f4eb10", "name": "Insecure pattern 'node_child_process' in scripts/brain-check.mjs:10", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/brain-check.mjs:10"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2be2a5ba32477d9a", "name": "Insecure pattern 'node_child_process' in scripts/deleted-radius-check.mjs:10", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/deleted-radius-check.mjs:10"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fa3f0346af472117", "name": "Insecure pattern 'node_child_process' in scripts/worktree-seed-check.mjs:15", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/worktree-seed-check.mjs:15"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aa3213787398c4af", "name": "Insecure pattern 'node_child_process' in scripts/run-integration.mjs:9", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/run-integration.mjs:9"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b7e47ed5cbda652f", "name": "Insecure pattern 'node_child_process' in scripts/cochange-check.mjs:12", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/cochange-check.mjs:12"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-43ca91a8491a6ca7", "name": "Insecure pattern 'node_child_process' in scripts/release.mjs:22", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/release.mjs:22"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9157ab6dace56d1d", "name": "Insecure pattern 'node_child_process' in scripts/sweep-check.mjs:12", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/sweep-check.mjs:12"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-08e1967c1841bc4a", "name": "Insecure pattern 'node_child_process' in packages/distill/src/github.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/distill/src/github.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d847232cf8ee4968", "name": "Insecure pattern 'node_child_process' in packages/distill/src/llm.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/distill/src/llm.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-453ffc589a19221c", "name": "Insecure pattern 'eval_used' in packages/cli/src/index.ts:320", "shortDescription": {"text": "Insecure pattern 'eval_used' in packages/cli/src/index.ts:320"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0808da654142cf75", "name": "Insecure pattern 'node_child_process' in packages/cli/src/index.ts:12", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/index.ts:12"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c6f06b950271ac08", "name": "Insecure pattern 'node_child_process' in packages/cli/src/serve.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/serve.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-85ba89f98af90cbd", "name": "Insecure pattern 'node_child_process' in packages/ingest/src/local.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/ingest/src/local.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-636092df78e01b06", "name": "Insecure pattern 'node_child_process' in packages/ingest/src/github.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/ingest/src/github.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3c74520f38e1fd83", "name": "Insecure pattern 'node_child_process' in packages/ingest/src/local.test.ts:2", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/ingest/src/local.test.ts:2"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d2ee0d6c591527fd", "name": "Insecure pattern 'node_child_process' in packages/code-graph/src/co-change.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/code-graph/src/co-change.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-921f43c0f08de282", "name": "Insecure pattern 'node_child_process' in packages/viz-server/src/daemon.ts:5", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/viz-server/src/daemon.ts:5"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-868f21cc5cfd4bbb", "name": "Insecure pattern 'direct_innerhtml_assignment' in packages/viz-server/src/ui.ts:125", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/viz-server/src/ui.ts:125"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a9456a42eb32551a", "name": "Insecure pattern 'node_child_process' in packages/engine/src/paths.ts:5", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/engine/src/paths.ts:5"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e147e03ea9a43042", "name": "Insecure pattern 'node_child_process' in packages/engine/src/review.ts:2", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/engine/src/review.ts:2"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cc5710e393031d7b", "name": "Node manifest has dependencies but no lockfile: packages/neighborhood/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/neighborhood/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3f47b1f51c04f12f", "name": "Node manifest has dependencies but no lockfile: packages/distill/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/distill/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8c2e3196a4ef0cdd", "name": "Node manifest has dependencies but no lockfile: packages/cli/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/cli/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5affae36179e9510", "name": "Node manifest has dependencies but no lockfile: packages/ingest/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/ingest/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8e98a1aeea449604", "name": "Node manifest has dependencies but no lockfile: packages/deterministic/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/deterministic/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d2b57a716276258", "name": "Node manifest has dependencies but no lockfile: packages/code-graph/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/code-graph/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d6843f63748547dc", "name": "Node manifest has dependencies but no lockfile: packages/findings/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/findings/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6cf7d86f806aee43", "name": "Node manifest has dependencies but no lockfile: packages/mcp-server/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/mcp-server/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-021d6e98c7abcdd7", "name": "Node manifest has dependencies but no lockfile: packages/viz-server/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/viz-server/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f9f13e1418f0ef36", "name": "Node manifest has dependencies but no lockfile: packages/engine/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/engine/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-faade62e621fe89c", "name": "Node manifest has dependencies but no lockfile: packages/knowledge/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/knowledge/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 21 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 16 placeholder/mock markers across 8 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cc55229a7a3c078d", "name": "Agent authority lacks a verifier contract: .mcp.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .mcp.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e1d3fbc30bead412", "name": "Agent instruction contains unpinned remote install: AGENTS.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: AGENTS.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bc15c74853dd18b9", "name": "Agent authority lacks a verifier contract: plugin/.mcp.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: plugin/.mcp.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cbc11348e2ed62c7", "name": "Agent authority lacks a verifier contract: packages/ingest/AGENTS.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: packages/ingest/AGENTS.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e1032a2de1fad9a4", "name": "Agent instruction/config may expose a secret: packages/findings/AGENTS.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: packages/findings/AGENTS.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3a058837336f6874", "name": "Commented-code block (5 lines) in plugin/scripts/gen-codex-skills.mjs:4", "shortDescription": {"text": "Commented-code block (5 lines) in plugin/scripts/gen-codex-skills.mjs:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d10cb56a6b08d7bf", "name": "Commented-code block (7 lines) in scripts/deleted-radius-check.mjs:1", "shortDescription": {"text": "Commented-code block (7 lines) in scripts/deleted-radius-check.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c2562744f8f052b0", "name": "Commented-code block (6 lines) in scripts/worktree-seed-check.mjs:1", "shortDescription": {"text": "Commented-code block (6 lines) in scripts/worktree-seed-check.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-78911e913151eaa6", "name": "Commented-code block (8 lines) in scripts/run-integration.mjs:1", "shortDescription": {"text": "Commented-code block (8 lines) in scripts/run-integration.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-aebaef254f509588", "name": "Commented-code block (5 lines) in scripts/cochange-check.mjs:1", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/cochange-check.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-86b1a807169aa06d", "name": "Commented-code block (7 lines) in packages/distill/src/cluster.test.ts:81", "shortDescription": {"text": "Commented-code block (7 lines) in packages/distill/src/cluster.test.ts:81"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0b8634b3bfce5d0a", "name": "Commented-code block (6 lines) in packages/distill/src/distill.ts:62", "shortDescription": {"text": "Commented-code block (6 lines) in packages/distill/src/distill.ts:62"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-977d5a0ee00c721f", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/distill/src/llm.ts:8", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/distill/src/llm.ts:8"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f7567c989082bede", "name": "Commented-code block (6 lines) in packages/cli/src/index.ts:269", "shortDescription": {"text": "Commented-code block (6 lines) in packages/cli/src/index.ts:269"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-59c2c2d9a240af36", "name": "Commented-code block (5 lines) in packages/ingest/src/normalize.ts:86", "shortDescription": {"text": "Commented-code block (5 lines) in packages/ingest/src/normalize.ts:86"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3741f0d78ae895bd", "name": "Commented-code block (5 lines) in packages/code-graph/src/build.ts:241", "shortDescription": {"text": "Commented-code block (5 lines) in packages/code-graph/src/build.ts:241"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fe036cf2ee8c64e3", "name": "Commented-code block (7 lines) in packages/findings/src/rounds.ts:109", "shortDescription": {"text": "Commented-code block (7 lines) in packages/findings/src/rounds.ts:109"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9d130ccf1788fd93", "name": "Commented-code block (6 lines) in packages/mcp-server/src/index.ts:398", "shortDescription": {"text": "Commented-code block (6 lines) in packages/mcp-server/src/index.ts:398"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7b78610b87ca77b4", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/viz-server/src/ui.ts:194", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/viz-server/src/ui.ts:194"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-01e47d933903195b", "name": "Commented-code block (5 lines) in packages/viz-server/src/collect.ts:129", "shortDescription": {"text": "Commented-code block (5 lines) in packages/viz-server/src/collect.ts:129"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-89396cf52998f067", "name": "Legacy-named symbol `repo_v2` in packages/engine/src/paths.test.ts:27", "shortDescription": {"text": "Legacy-named symbol `repo_v2` in packages/engine/src/paths.test.ts:27"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e2dab3b3eb1b34f8", "name": "Commented-code block (5 lines) in packages/engine/src/verdicts.test.ts:47", "shortDescription": {"text": "Commented-code block (5 lines) in packages/engine/src/verdicts.test.ts:47"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-53b66fd92a4bcba8", "name": "Commented-code block (5 lines) in packages/engine/src/paths.ts:117", "shortDescription": {"text": "Commented-code block (5 lines) in packages/engine/src/paths.ts:117"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ec3e8ed482fffb65", "name": "Commented-code block (10 lines) in packages/engine/src/findings.ts:80", "shortDescription": {"text": "Commented-code block (10 lines) in packages/engine/src/findings.ts:80"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-76467962ec40cbd4", "name": "Commented-code block (6 lines) in packages/engine/src/knowledge.ts:332", "shortDescription": {"text": "Commented-code block (6 lines) in packages/engine/src/knowledge.ts:332"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-41b71218bcc2613f", "name": "Commented-code block (5 lines) in packages/engine/src/analyze.test.ts:9", "shortDescription": {"text": "Commented-code block (5 lines) in packages/engine/src/analyze.test.ts:9"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4027f5b61bb88ba7", "name": "Commented-code block (12 lines) in packages/engine/src/review.ts:97", "shortDescription": {"text": "Commented-code block (12 lines) in packages/engine/src/review.ts:97"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3cc362f7937bd088", "name": "Commented-code block (5 lines) in packages/core/src/providers.test.ts:79", "shortDescription": {"text": "Commented-code block (5 lines) in packages/core/src/providers.test.ts:79"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b255e28342d1b202", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/knowledge/src/embeddings.ts:38", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/knowledge/src/embeddings.ts:38"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-25b5186b08aabd99", "name": "Legacy-named symbol `wOld` in packages/knowledge/src/promotion.test.ts:153", "shortDescription": {"text": "Legacy-named symbol `wOld` in packages/knowledge/src/promotion.test.ts:153"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-22e06f5aad4d9685", "name": "Commented-code block (19 lines) in packages/knowledge/src/retrieve.ts:65", "shortDescription": {"text": "Commented-code block (19 lines) in packages/knowledge/src/retrieve.ts:65"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8f1a31871d7e2f4a", "name": "Commented-code block (5 lines) in packages/knowledge/src/promotion.ts:107", "shortDescription": {"text": "Commented-code block (5 lines) in packages/knowledge/src/promotion.ts:107"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/20200"}, "properties": {"repository": "sshanzel/plex", "repoUrl": "https://github.com/sshanzel/plex", "branch": "main"}, "results": [{"ruleId": "scanner-0478b77fac174935", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/deterministic/src/builtin.test.ts:5"}, "properties": {"repobilityId": "d26c1a019e6e83fd", "scanner": "scanner-primary", "fingerprint": "0478b77fac174935", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-480cb0c716fbc07d", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/deterministic/src/runner.test.ts:99"}, "properties": {"repobilityId": "f75ca0c94c01273a", "scanner": "scanner-primary", "fingerprint": "480cb0c716fbc07d", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-2e7ebf61b02e8651", "level": "note", "message": {"text": "React Flow edge with `label=` but no project-wide edge-label CSS override \u2014 packages/viz-server/src/ui.ts:176"}, "properties": {"repobilityId": "0e915a9e4b93b35b", "scanner": "scanner-primary", "fingerprint": "2e7ebf61b02e8651", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.edge-label.no-bg"]}}, {"ruleId": "scanner-2e575955dafbf1b1", "level": "warning", "message": {"text": "Privileged port 59 in use"}, "properties": {"repobilityId": "6c14a9dab4958e92", "scanner": "scanner-primary", "fingerprint": "2e575955dafbf1b1", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/viz-server/src/daemon.test.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-14b61c3d97f4eb10", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/brain-check.mjs:10"}, "properties": {"repobilityId": "edc1a26953e43d04", "scanner": "scanner-primary", "fingerprint": "14b61c3d97f4eb10", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/brain-check.mjs"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-2be2a5ba32477d9a", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/deleted-radius-check.mjs:10"}, "properties": {"repobilityId": "3a60517e591f40cd", "scanner": "scanner-primary", "fingerprint": "2be2a5ba32477d9a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/deleted-radius-check.mjs"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-fa3f0346af472117", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/worktree-seed-check.mjs:15"}, "properties": {"repobilityId": "614ed29cc2aac15b", "scanner": "scanner-primary", "fingerprint": "fa3f0346af472117", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/worktree-seed-check.mjs"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-aa3213787398c4af", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/run-integration.mjs:9"}, "properties": {"repobilityId": "e28b3bf6bfcaad91", "scanner": "scanner-primary", "fingerprint": "aa3213787398c4af", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/run-integration.mjs"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-b7e47ed5cbda652f", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/cochange-check.mjs:12"}, "properties": {"repobilityId": "d530da8310daac82", "scanner": "scanner-primary", "fingerprint": "b7e47ed5cbda652f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/cochange-check.mjs"}, "region": {"startLine": 12}}}]}, {"ruleId": "scanner-43ca91a8491a6ca7", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/release.mjs:22"}, "properties": {"repobilityId": "b54b635c778fb88f", "scanner": "scanner-primary", "fingerprint": "43ca91a8491a6ca7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/release.mjs"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-9157ab6dace56d1d", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/sweep-check.mjs:12"}, "properties": {"repobilityId": "2b678ca54b5e53af", "scanner": "scanner-primary", "fingerprint": "9157ab6dace56d1d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/sweep-check.mjs"}, "region": {"startLine": 12}}}]}, {"ruleId": "scanner-08e1967c1841bc4a", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/distill/src/github.ts:1"}, "properties": {"repobilityId": "3e1f398b757be1d2", "scanner": "scanner-primary", "fingerprint": "08e1967c1841bc4a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/distill/src/github.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d847232cf8ee4968", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/distill/src/llm.ts:1"}, "properties": {"repobilityId": "d78a8a5bfc0413b2", "scanner": "scanner-primary", "fingerprint": "d847232cf8ee4968", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/distill/src/llm.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-453ffc589a19221c", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in packages/cli/src/index.ts:320"}, "properties": {"repobilityId": "7e662d604d7a9941", "scanner": "scanner-primary", "fingerprint": "453ffc589a19221c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/index.ts"}, "region": {"startLine": 320}}}]}, {"ruleId": "scanner-0808da654142cf75", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/index.ts:12"}, "properties": {"repobilityId": "3c049ec071195256", "scanner": "scanner-primary", "fingerprint": "0808da654142cf75", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/index.ts"}, "region": {"startLine": 12}}}]}, {"ruleId": "scanner-c6f06b950271ac08", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/serve.ts:1"}, "properties": {"repobilityId": "32b17bded212d9eb", "scanner": "scanner-primary", "fingerprint": "c6f06b950271ac08", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/serve.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-85ba89f98af90cbd", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/ingest/src/local.ts:1"}, "properties": {"repobilityId": "862ca8518ec56ed0", "scanner": "scanner-primary", "fingerprint": "85ba89f98af90cbd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/ingest/src/local.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-636092df78e01b06", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/ingest/src/github.ts:1"}, "properties": {"repobilityId": "220a39ca8efa327b", "scanner": "scanner-primary", "fingerprint": "636092df78e01b06", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/ingest/src/github.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3c74520f38e1fd83", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/ingest/src/local.test.ts:2"}, "properties": {"repobilityId": "b34cea4cd3cd35ab", "scanner": "scanner-primary", "fingerprint": "3c74520f38e1fd83", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/ingest/src/local.test.ts"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-d2ee0d6c591527fd", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/code-graph/src/co-change.ts:1"}, "properties": {"repobilityId": "15f3103a767577ac", "scanner": "scanner-primary", "fingerprint": "d2ee0d6c591527fd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/code-graph/src/co-change.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-921f43c0f08de282", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/viz-server/src/daemon.ts:5"}, "properties": {"repobilityId": "80d8a9b0060824e3", "scanner": "scanner-primary", "fingerprint": "921f43c0f08de282", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/viz-server/src/daemon.ts"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-868f21cc5cfd4bbb", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in packages/viz-server/src/ui.ts:125"}, "properties": {"repobilityId": "1551fef36c8c6c5b", "scanner": "scanner-primary", "fingerprint": "868f21cc5cfd4bbb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/viz-server/src/ui.ts"}, "region": {"startLine": 125}}}]}, {"ruleId": "scanner-a9456a42eb32551a", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/engine/src/paths.ts:5"}, "properties": {"repobilityId": "11f75f282e9eefb6", "scanner": "scanner-primary", "fingerprint": "a9456a42eb32551a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/engine/src/paths.ts"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-e147e03ea9a43042", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/engine/src/review.ts:2"}, "properties": {"repobilityId": "fc99e3459698ee45", "scanner": "scanner-primary", "fingerprint": "e147e03ea9a43042", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/engine/src/review.ts"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cc5710e393031d7b", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/neighborhood/package.json"}, "properties": {"repobilityId": "e4001f876ba17cec", "scanner": "scanner-primary", "fingerprint": "cc5710e393031d7b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/neighborhood/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3f47b1f51c04f12f", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/distill/package.json"}, "properties": {"repobilityId": "f2254acf77354d3f", "scanner": "scanner-primary", "fingerprint": "3f47b1f51c04f12f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/distill/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8c2e3196a4ef0cdd", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/cli/package.json"}, "properties": {"repobilityId": "2faf23490612d7a6", "scanner": "scanner-primary", "fingerprint": "8c2e3196a4ef0cdd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5affae36179e9510", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/ingest/package.json"}, "properties": {"repobilityId": "2382fb625e438b9d", "scanner": "scanner-primary", "fingerprint": "5affae36179e9510", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/ingest/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8e98a1aeea449604", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/deterministic/package.json"}, "properties": {"repobilityId": "a193b64bc2db19a2", "scanner": "scanner-primary", "fingerprint": "8e98a1aeea449604", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/deterministic/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2d2b57a716276258", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/code-graph/package.json"}, "properties": {"repobilityId": "a37110b9d1de3909", "scanner": "scanner-primary", "fingerprint": "2d2b57a716276258", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/code-graph/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d6843f63748547dc", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/findings/package.json"}, "properties": {"repobilityId": "4522f3b2d07d1c97", "scanner": "scanner-primary", "fingerprint": "d6843f63748547dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/findings/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6cf7d86f806aee43", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/mcp-server/package.json"}, "properties": {"repobilityId": "a25c45fd100dcd3e", "scanner": "scanner-primary", "fingerprint": "6cf7d86f806aee43", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/mcp-server/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-021d6e98c7abcdd7", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/viz-server/package.json"}, "properties": {"repobilityId": "6f0b3b7b7a6eb633", "scanner": "scanner-primary", "fingerprint": "021d6e98c7abcdd7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/viz-server/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f9f13e1418f0ef36", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/engine/package.json"}, "properties": {"repobilityId": "81a373b6a2e74e41", "scanner": "scanner-primary", "fingerprint": "f9f13e1418f0ef36", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/engine/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-faade62e621fe89c", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/knowledge/package.json"}, "properties": {"repobilityId": "9c1c3a3cd6430e6b", "scanner": "scanner-primary", "fingerprint": "faade62e621fe89c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/knowledge/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "939644fdec3713b0", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "8cb79a916e9840ef", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "3a8842896cd7941b", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "fe7dfc545c94ddf9", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "4a378916595f77e5", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "b3eacb88f6cca6c8", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-cc55229a7a3c078d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .mcp.json"}, "properties": {"repobilityId": "51942fb3d5b8b5b4", "scanner": "scanner-primary", "fingerprint": "cc55229a7a3c078d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "mcp_config"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".mcp.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e1d3fbc30bead412", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: AGENTS.md"}, "properties": {"repobilityId": "56bfc666b358d0d0", "scanner": "scanner-primary", "fingerprint": "e1d3fbc30bead412", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "agents_md"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "AGENTS.md"}, "region": {"startLine": 90}}}]}, {"ruleId": "scanner-bc15c74853dd18b9", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: plugin/.mcp.json"}, "properties": {"repobilityId": "28c831bd0ad754d8", "scanner": "scanner-primary", "fingerprint": "bc15c74853dd18b9", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "mcp_config"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugin/.mcp.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cbc11348e2ed62c7", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: packages/ingest/AGENTS.md"}, "properties": {"repobilityId": "46990264f160590f", "scanner": "scanner-primary", "fingerprint": "cbc11348e2ed62c7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agents_md"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/ingest/AGENTS.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e1032a2de1fad9a4", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: packages/findings/AGENTS.md"}, "properties": {"repobilityId": "f02fb0065a7d2b7e", "scanner": "scanner-primary", "fingerprint": "e1032a2de1fad9a4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "agents_md"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/findings/AGENTS.md"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-3a058837336f6874", "level": "none", "message": {"text": "Commented-code block (5 lines) in plugin/scripts/gen-codex-skills.mjs:4"}, "properties": {"repobilityId": "52e58222343e65e9", "scanner": "scanner-primary", "fingerprint": "3a058837336f6874", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d10cb56a6b08d7bf", "level": "none", "message": {"text": "Commented-code block (7 lines) in scripts/deleted-radius-check.mjs:1"}, "properties": {"repobilityId": "18e199a2bcd5be8d", "scanner": "scanner-primary", "fingerprint": "d10cb56a6b08d7bf", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c2562744f8f052b0", "level": "none", "message": {"text": "Commented-code block (6 lines) in scripts/worktree-seed-check.mjs:1"}, "properties": {"repobilityId": "cc7565cdce11c02e", "scanner": "scanner-primary", "fingerprint": "c2562744f8f052b0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-78911e913151eaa6", "level": "none", "message": {"text": "Commented-code block (8 lines) in scripts/run-integration.mjs:1"}, "properties": {"repobilityId": "4a4b2a0e49445abd", "scanner": "scanner-primary", "fingerprint": "78911e913151eaa6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-aebaef254f509588", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/cochange-check.mjs:1"}, "properties": {"repobilityId": "81743db841deb260", "scanner": "scanner-primary", "fingerprint": "aebaef254f509588", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-86b1a807169aa06d", "level": "none", "message": {"text": "Commented-code block (7 lines) in packages/distill/src/cluster.test.ts:81"}, "properties": {"repobilityId": "852a324d2f28fb50", "scanner": "scanner-primary", "fingerprint": "86b1a807169aa06d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0b8634b3bfce5d0a", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/distill/src/distill.ts:62"}, "properties": {"repobilityId": "a6fbe7a84aba4645", "scanner": "scanner-primary", "fingerprint": "0b8634b3bfce5d0a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-977d5a0ee00c721f", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/distill/src/llm.ts:8"}, "properties": {"repobilityId": "15d24f92a0f35f15", "scanner": "scanner-primary", "fingerprint": "977d5a0ee00c721f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-f7567c989082bede", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/cli/src/index.ts:269"}, "properties": {"repobilityId": "fe0fc758b5b95b0d", "scanner": "scanner-primary", "fingerprint": "f7567c989082bede", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-59c2c2d9a240af36", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/ingest/src/normalize.ts:86"}, "properties": {"repobilityId": "ed37ed0a4f8ee2ad", "scanner": "scanner-primary", "fingerprint": "59c2c2d9a240af36", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3741f0d78ae895bd", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/code-graph/src/build.ts:241"}, "properties": {"repobilityId": "e519dd95a9b52e56", "scanner": "scanner-primary", "fingerprint": "3741f0d78ae895bd", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fe036cf2ee8c64e3", "level": "none", "message": {"text": "Commented-code block (7 lines) in packages/findings/src/rounds.ts:109"}, "properties": {"repobilityId": "4bfd4b3975e3db06", "scanner": "scanner-primary", "fingerprint": "fe036cf2ee8c64e3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9d130ccf1788fd93", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/mcp-server/src/index.ts:398"}, "properties": {"repobilityId": "4d2fba5ec082a12c", "scanner": "scanner-primary", "fingerprint": "9d130ccf1788fd93", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7b78610b87ca77b4", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/viz-server/src/ui.ts:194"}, "properties": {"repobilityId": "a328d21ea4d37b71", "scanner": "scanner-primary", "fingerprint": "7b78610b87ca77b4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-01e47d933903195b", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/viz-server/src/collect.ts:129"}, "properties": {"repobilityId": "5bcaf942bd71aa68", "scanner": "scanner-primary", "fingerprint": "01e47d933903195b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-89396cf52998f067", "level": "note", "message": {"text": "Legacy-named symbol `repo_v2` in packages/engine/src/paths.test.ts:27"}, "properties": {"repobilityId": "7682e2b6f3fd8b70", "scanner": "scanner-primary", "fingerprint": "89396cf52998f067", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-e2dab3b3eb1b34f8", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/engine/src/verdicts.test.ts:47"}, "properties": {"repobilityId": "67419f53ea55e695", "scanner": "scanner-primary", "fingerprint": "e2dab3b3eb1b34f8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-53b66fd92a4bcba8", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/engine/src/paths.ts:117"}, "properties": {"repobilityId": "e7737dbcc234de37", "scanner": "scanner-primary", "fingerprint": "53b66fd92a4bcba8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ec3e8ed482fffb65", "level": "none", "message": {"text": "Commented-code block (10 lines) in packages/engine/src/findings.ts:80"}, "properties": {"repobilityId": "cac58b8eb14b347c", "scanner": "scanner-primary", "fingerprint": "ec3e8ed482fffb65", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-76467962ec40cbd4", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/engine/src/knowledge.ts:332"}, "properties": {"repobilityId": "57e8889ba5a902ed", "scanner": "scanner-primary", "fingerprint": "76467962ec40cbd4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-41b71218bcc2613f", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/engine/src/analyze.test.ts:9"}, "properties": {"repobilityId": "fec3d7b6cbb56340", "scanner": "scanner-primary", "fingerprint": "41b71218bcc2613f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4027f5b61bb88ba7", "level": "none", "message": {"text": "Commented-code block (12 lines) in packages/engine/src/review.ts:97"}, "properties": {"repobilityId": "d1f396e9590434a0", "scanner": "scanner-primary", "fingerprint": "4027f5b61bb88ba7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3cc362f7937bd088", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/core/src/providers.test.ts:79"}, "properties": {"repobilityId": "2cc4e0de34b235c2", "scanner": "scanner-primary", "fingerprint": "3cc362f7937bd088", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b255e28342d1b202", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/knowledge/src/embeddings.ts:38"}, "properties": {"repobilityId": "eb571877485fec14", "scanner": "scanner-primary", "fingerprint": "b255e28342d1b202", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-25b5186b08aabd99", "level": "note", "message": {"text": "Legacy-named symbol `wOld` in packages/knowledge/src/promotion.test.ts:153"}, "properties": {"repobilityId": "3aca5bb62410d108", "scanner": "scanner-primary", "fingerprint": "25b5186b08aabd99", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-22e06f5aad4d9685", "level": "none", "message": {"text": "Commented-code block (19 lines) in packages/knowledge/src/retrieve.ts:65"}, "properties": {"repobilityId": "942d4c0e4f05cb97", "scanner": "scanner-primary", "fingerprint": "22e06f5aad4d9685", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8f1a31871d7e2f4a", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/knowledge/src/promotion.ts:107"}, "properties": {"repobilityId": "d1af9bf1211f5a32", "scanner": "scanner-primary", "fingerprint": "8f1a31871d7e2f4a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}]}]}