{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-4257a24f677b6772", "name": "Stray `console.log` in TS/JS \u2014 proof-of-concept/packages/runner/src/check-react.ts:4", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 proof-of-concept/packages/runner/src/check-react.ts:4"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-69bbbf625b2a6656", "name": "Stray `console.log` in TS/JS \u2014 proof-of-concept/packages/recorder/test/console-capture.test.ts:109", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 proof-of-concept/packages/recorder/test/console-capture.test.ts:109"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c3dd5a0878444283", "name": "Stray `console.log` in TS/JS \u2014 proof-of-concept/packages/dashboard/server/index.ts:81", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 proof-of-concept/packages/dashboard/server/index.ts:81"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-de3a54e655f96cdd", "name": "`truncate` class without `title=` for hover reveal \u2014 proof-of-concept/packages/dashboard/src/app/SessionsPanel.tsx:123", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 proof-of-concept/packages/dashboard/src/app/SessionsPanel.tsx:123"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a15247ebcceb38ed", "name": "`truncate` class without `title=` for hover reveal \u2014 proof-of-concept/packages/dashboard/src/app/OverviewPanel.tsx:171", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 proof-of-concept/packages/dashboard/src/app/OverviewPanel.tsx:171"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5880976c8d334206", "name": "`truncate` class without `title=` for hover reveal \u2014 marketing-site/src/components/demo/ScenePrCard.tsx:51", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 marketing-site/src/components/demo/ScenePrCard.tsx:51"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4f0c802831c5a265", "name": "`truncate` class without `title=` for hover reveal \u2014 marketing-site/src/components/demo/ScenePipeline.tsx:67", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 marketing-site/src/components/demo/ScenePipeline.tsx:67"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-80a8289c951b093f", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 marketing-site/src/app/layout.tsx:145", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 marketing-site/src/app/layout.tsx:145"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ce4a087c09c760f6", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 marketing-site/src/app/blog/[slug]/page.tsx:90", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 marketing-site/src/app/blog/[slug]/page.tsx:90"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-42ffd995bd9189fe", "name": "Stray `console.log` in TS/JS \u2014 marketing-site/src/app/examples/speechlab-waveform/page.tsx:200", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 marketing-site/src/app/examples/speechlab-waveform/page.tsx:200"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bfbb8222a3e928a0", "name": "Stray `console.log` in TS/JS \u2014 .github/scripts/eval-runner/grade.ts:349", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 .github/scripts/eval-runner/grade.ts:349"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a7e2b0b6246ef8c2", "name": "Stray `console.log` in TS/JS \u2014 .github/scripts/eval-runner/run-eval.ts:200", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 .github/scripts/eval-runner/run-eval.ts:200"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-43bc68fb9cc35dae", "name": "Privileged port 3 in use", "shortDescription": {"text": "Privileged port 3 in use"}, "fullDescription": {"text": "Port 3 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-42835cfc10ea3cca", "name": "Privileged port 15 in use", "shortDescription": {"text": "Privileged port 15 in use"}, "fullDescription": {"text": "Port 15 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f6fa16548103cdfe", "name": "Privileged port 2 in use", "shortDescription": {"text": "Privileged port 2 in use"}, "fullDescription": {"text": "Port 2 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ae35eb07f15a4ad2", "name": "Insecure pattern 'node_child_process' in scripts/release-captain/run.mjs:23", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/release-captain/run.mjs:23"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dff3efb8a29e3841", "name": "Insecure pattern 'insert_adjacent_html' in .claude/skills/cuit-instrument-workspace/iteration-1/viewer.html:101", "shortDescription": {"text": "Insecure pattern 'insert_adjacent_html' in .claude/skills/cuit-instrument-workspace/iteration-1/viewer.html:101"}, "fullDescription": {"text": "Found a known-risky pattern (insert_adjacent_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d977cfe822664b02", "name": "Insecure pattern 'dangerous_innerhtml' in marketing-site/src/app/layout.tsx:145", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in marketing-site/src/app/layout.tsx:145"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d298449fe8fc0c5f", "name": "Insecure pattern 'dangerous_innerhtml' in marketing-site/src/app/blog/[slug]/page.tsx:90", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in marketing-site/src/app/blog/[slug]/page.tsx:90"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-98fc1a72c0c47827", "name": "Insecure pattern 'cors_wildcard' in marketing-site/src/app/openapi.json/route.ts:16", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in marketing-site/src/app/openapi.json/route.ts:16"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e6e8f983e6d3331b", "name": "Insecure pattern 'node_child_process' in .github/workflows/agent-loop-dogfood-bot.yml:224", "shortDescription": {"text": "Insecure pattern 'node_child_process' in .github/workflows/agent-loop-dogfood-bot.yml:224"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fe8f2685ec118c84", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-47187cd80d0b0b66", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-76fc4ebe6275fb44", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-69d91c030d9c438b", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-23742503b49301cf", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1ba5b07ee5ce81be", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2ec83b573a5b1bd3", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dc1dcc4d6dae3216", "name": "Node manifest has dependencies but no lockfile: scripts/release-captain/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: scripts/release-captain/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-026cd228dbbea963", "name": "Node manifest has dependencies but no lockfile: proof-of-concept/packages/recorder-extension/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: proof-of-concept/packages/recorder-extension/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9f7d1dbc016a0885", "name": "Node manifest has dependencies but no lockfile: proof-of-concept/packages/types/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: proof-of-concept/packages/types/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-227ce86a6089946b", "name": "Node manifest has dependencies but no lockfile: proof-of-concept/packages/runner/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: proof-of-concept/packages/runner/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6e6ffc6fdca344d0", "name": "Node manifest has dependencies but no lockfile: proof-of-concept/packages/recorder/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: proof-of-concept/packages/recorder/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-71ff9afe6e3fe3f1", "name": "Node manifest has dependencies but no lockfile: proof-of-concept/packages/dashboard/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: proof-of-concept/packages/dashboard/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1581e4769f4c86c5", "name": "Node manifest has dependencies but no lockfile: proof-of-concept/packages/adapter-cuit/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: proof-of-concept/packages/adapter-cuit/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-46c0c8f3f8b4dd9f", "name": "Node manifest has dependencies but no lockfile: proof-of-concept/packages/demo-app/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: proof-of-concept/packages/demo-app/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-00e3373f0a5e4bae", "name": "Node manifest has dependencies but no lockfile: proof-of-concept/packages/adapter-jam/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: proof-of-concept/packages/adapter-jam/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2e9511ec34aa1927", "name": "Node manifest has dependencies but no lockfile: proof-of-concept/packages/spec-gen/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: proof-of-concept/packages/spec-gen/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-947a2495c36fd3f1", "name": "Node manifest has dependencies but no lockfile: proof-of-concept/packages/harness/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: proof-of-concept/packages/harness/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8bfd79362b04dd44", "name": "Node manifest has dependencies but no lockfile: proof-of-concept/packages/mcp-local/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: proof-of-concept/packages/mcp-local/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e9207f9f5cbb591c", "name": "Node manifest has dependencies but no lockfile: .github/scripts/eval-runner/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: .github/scripts/eval-runner/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 25 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 23 placeholder/mock markers across 8 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a80ee56eec2c2a26", "name": "Agent authority lacks a verifier contract: .claude/skills/cuit-loop/README.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/cuit-loop/README.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6c766c73ed45098d", "name": "Agent authority lacks a verifier contract: .claude/skills/cuit-loop/evals/README.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/cuit-loop/evals/README.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-64fa7705c3daa665", "name": "Agent authority lacks a verifier contract: .claude/skills/cuit-loop/evals/assertions.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/cuit-loop/evals/assertions.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3afb07bd3501c73c", "name": "Agent authority lacks a verifier contract: .claude/skills/cuit-instrument-workspace/iteration-1/assertions.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/cuit-instrument-workspace/iteration-1/assertions.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1d8bb3c565d952da", "name": "Agent authority lacks a verifier contract: .claude/skills/cuit-instrument-workspace/iteration-1/eval-7-almost-trigger-di", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/cuit-instrument-workspace/iteration-1/eval-7-almost-trigger-different-skill/with_skill/outputs/decision.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7627aea26839f4e8", "name": "Agent authority lacks a verifier contract: .claude/skills/cuit-instrument-workspace/iteration-1/eval-7-almost-trigger-di", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/cuit-instrument-workspace/iteration-1/eval-7-almost-trigger-different-skill/without_skill/outputs/decision.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b20cca781fe2494f", "name": "Agent authority lacks a verifier contract: .claude/skills/cuit-instrument-workspace/iteration-1/eval-10-chrome-extension", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/cuit-instrument-workspace/iteration-1/eval-10-chrome-extension-install-question/with_skill/outputs/decision.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9c97b52bd9ec9fc9", "name": "Agent authority lacks a verifier contract: .claude/skills/cuit-instrument-workspace/iteration-1/eval-4-with-bug-not-inst", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/cuit-instrument-workspace/iteration-1/eval-4-with-bug-not-instrument/without_skill/outputs/decision.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d8eeb0432ff7d00e", "name": "Agent authority lacks a verifier contract: .claude/skills/cuit-instrument/evals/assertions.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/cuit-instrument/evals/assertions.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b8a1bca1916ef014", "name": "Commented-code block (8 lines) in proof-of-concept/packages/recorder-extension/build.mjs:7", "shortDescription": {"text": "Commented-code block (8 lines) in proof-of-concept/packages/recorder-extension/build.mjs:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e0016f9fdd94daa3", "name": "Commented-code block (5 lines) in proof-of-concept/packages/recorder-extension/test/extension.test.ts:386", "shortDescription": {"text": "Commented-code block (5 lines) in proof-of-concept/packages/recorder-extension/test/extension.test.ts:386"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-88a8339086a921af", "name": "Commented-code block (6 lines) in proof-of-concept/packages/recorder-extension/test/build-parity.test.ts:381", "shortDescription": {"text": "Commented-code block (6 lines) in proof-of-concept/packages/recorder-extension/test/build-parity.test.ts:381"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-414a7bcb0b8a5531", "name": "Commented-code block (5 lines) in proof-of-concept/packages/recorder-extension/src/content.entry.ts:10", "shortDescription": {"text": "Commented-code block (5 lines) in proof-of-concept/packages/recorder-extension/src/content.entry.ts:10"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-61a67759905f81ed", "name": "Commented-code block (9 lines) in proof-of-concept/packages/types/test/console-event.test.ts:267", "shortDescription": {"text": "Commented-code block (9 lines) in proof-of-concept/packages/types/test/console-event.test.ts:267"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3be7b7a34d074d44", "name": "Commented-code block (6 lines) in proof-of-concept/packages/runner/test/real-exec.test.ts:551", "shortDescription": {"text": "Commented-code block (6 lines) in proof-of-concept/packages/runner/test/real-exec.test.ts:551"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-72a85a51119b8bc7", "name": "Legacy-named symbol `executeSpecLegacy` in proof-of-concept/packages/runner/src/index.ts:187", "shortDescription": {"text": "Legacy-named symbol `executeSpecLegacy` in proof-of-concept/packages/runner/src/index.ts:187"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2cc4976d8801c859", "name": "Commented-code block (6 lines) in proof-of-concept/packages/dashboard/test/proxy.test.ts:386", "shortDescription": {"text": "Commented-code block (6 lines) in proof-of-concept/packages/dashboard/test/proxy.test.ts:386"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-634b9ce18b5a542a", "name": "Commented-code block (5 lines) in proof-of-concept/packages/dashboard/test/chat.test.ts:330", "shortDescription": {"text": "Commented-code block (5 lines) in proof-of-concept/packages/dashboard/test/chat.test.ts:330"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-01d1a89725e29f40", "name": "Commented-code block (8 lines) in proof-of-concept/packages/dashboard/test/data.test.ts:39", "shortDescription": {"text": "Commented-code block (8 lines) in proof-of-concept/packages/dashboard/test/data.test.ts:39"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2dbd6a50c13e5fc1", "name": "`fetch()` without try/.catch or AbortSignal \u2014 proof-of-concept/packages/dashboard/src/chat.ts:269", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 proof-of-concept/packages/dashboard/src/chat.ts:269"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8f770000f4f5ac84", "name": "Commented-code block (7 lines) in proof-of-concept/packages/spec-gen/test/console-signal.test.ts:18", "shortDescription": {"text": "Commented-code block (7 lines) in proof-of-concept/packages/spec-gen/test/console-signal.test.ts:18"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-678a6a6365c3cb73", "name": "Commented-code block (5 lines) in proof-of-concept/packages/spec-gen/src/index.ts:164", "shortDescription": {"text": "Commented-code block (5 lines) in proof-of-concept/packages/spec-gen/src/index.ts:164"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-38e6f52132e51dd8", "name": "Commented-code block (8 lines) in .github/scripts/eval-runner/run-eval.ts:71", "shortDescription": {"text": "Commented-code block (8 lines) in .github/scripts/eval-runner/run-eval.ts:71"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/20109"}, "properties": {"repository": "speechlabinc/complex-ui-tester", "repoUrl": "https://github.com/speechlabinc/complex-ui-tester", "branch": "main"}, "results": [{"ruleId": "scanner-4257a24f677b6772", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 proof-of-concept/packages/runner/src/check-react.ts:4"}, "properties": {"repobilityId": "dfc49cb250123e59", "scanner": "scanner-primary", "fingerprint": "4257a24f677b6772", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-69bbbf625b2a6656", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 proof-of-concept/packages/recorder/test/console-capture.test.ts:109"}, "properties": {"repobilityId": "c2a265d98986f788", "scanner": "scanner-primary", "fingerprint": "69bbbf625b2a6656", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-c3dd5a0878444283", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 proof-of-concept/packages/dashboard/server/index.ts:81"}, "properties": {"repobilityId": "ce4a282c804101ea", "scanner": "scanner-primary", "fingerprint": "c3dd5a0878444283", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-de3a54e655f96cdd", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 proof-of-concept/packages/dashboard/src/app/SessionsPanel.tsx:123"}, "properties": {"repobilityId": "aad9d5699aa20987", "scanner": "scanner-primary", "fingerprint": "de3a54e655f96cdd", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-a15247ebcceb38ed", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 proof-of-concept/packages/dashboard/src/app/OverviewPanel.tsx:171"}, "properties": {"repobilityId": "7df135b5ec01c239", "scanner": "scanner-primary", "fingerprint": "a15247ebcceb38ed", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-5880976c8d334206", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 marketing-site/src/components/demo/ScenePrCard.tsx:51"}, "properties": {"repobilityId": "fb02a4b83667373b", "scanner": "scanner-primary", "fingerprint": "5880976c8d334206", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-4f0c802831c5a265", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 marketing-site/src/components/demo/ScenePipeline.tsx:67"}, "properties": {"repobilityId": "22fe2dad621dff4b", "scanner": "scanner-primary", "fingerprint": "4f0c802831c5a265", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-80a8289c951b093f", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 marketing-site/src/app/layout.tsx:145"}, "properties": {"repobilityId": "2d0aac56a741612d", "scanner": "scanner-primary", "fingerprint": "80a8289c951b093f", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-ce4a087c09c760f6", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 marketing-site/src/app/blog/[slug]/page.tsx:90"}, "properties": {"repobilityId": "55073f50dcf8f755", "scanner": "scanner-primary", "fingerprint": "ce4a087c09c760f6", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-42ffd995bd9189fe", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 marketing-site/src/app/examples/speechlab-waveform/page.tsx:200"}, "properties": {"repobilityId": "79668e8dbb86df31", "scanner": "scanner-primary", "fingerprint": "42ffd995bd9189fe", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-bfbb8222a3e928a0", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 .github/scripts/eval-runner/grade.ts:349"}, "properties": {"repobilityId": "9695ac9fb81854f4", "scanner": "scanner-primary", "fingerprint": "bfbb8222a3e928a0", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a7e2b0b6246ef8c2", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 .github/scripts/eval-runner/run-eval.ts:200"}, "properties": {"repobilityId": "1dafe8fe04dfc91a", "scanner": "scanner-primary", "fingerprint": "a7e2b0b6246ef8c2", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-43bc68fb9cc35dae", "level": "warning", "message": {"text": "Privileged port 3 in use"}, "properties": {"repobilityId": "261b7b1c6a18d412", "scanner": "scanner-primary", "fingerprint": "43bc68fb9cc35dae", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agent-eval-gatekeeper.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-42835cfc10ea3cca", "level": "warning", "message": {"text": "Privileged port 15 in use"}, "properties": {"repobilityId": "3340f9a170f285cd", "scanner": "scanner-primary", "fingerprint": "42835cfc10ea3cca", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agent-eval-gatekeeper.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f6fa16548103cdfe", "level": "warning", "message": {"text": "Privileged port 2 in use"}, "properties": {"repobilityId": "755b04866010e843", "scanner": "scanner-primary", "fingerprint": "f6fa16548103cdfe", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agent-loop-dogfood-bot.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ae35eb07f15a4ad2", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/release-captain/run.mjs:23"}, "properties": {"repobilityId": "5b759d5e32ab9917", "scanner": "scanner-primary", "fingerprint": "ae35eb07f15a4ad2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/release-captain/run.mjs"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-dff3efb8a29e3841", "level": "warning", "message": {"text": "Insecure pattern 'insert_adjacent_html' in .claude/skills/cuit-instrument-workspace/iteration-1/viewer.html:101"}, "properties": {"repobilityId": "148a69512b01dedc", "scanner": "scanner-primary", "fingerprint": "dff3efb8a29e3841", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "insert_adjacent_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/cuit-instrument-workspace/iteration-1/viewer.html"}, "region": {"startLine": 101}}}]}, {"ruleId": "scanner-d977cfe822664b02", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in marketing-site/src/app/layout.tsx:145"}, "properties": {"repobilityId": "953e0988541e9380", "scanner": "scanner-primary", "fingerprint": "d977cfe822664b02", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "marketing-site/src/app/layout.tsx"}, "region": {"startLine": 145}}}]}, {"ruleId": "scanner-d298449fe8fc0c5f", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in marketing-site/src/app/blog/[slug]/page.tsx:90"}, "properties": {"repobilityId": "5b4511632c5d2e21", "scanner": "scanner-primary", "fingerprint": "d298449fe8fc0c5f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "marketing-site/src/app/blog/[slug]/page.tsx"}, "region": {"startLine": 90}}}]}, {"ruleId": "scanner-98fc1a72c0c47827", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in marketing-site/src/app/openapi.json/route.ts:16"}, "properties": {"repobilityId": "fd92a0fbf4ec23a8", "scanner": "scanner-primary", "fingerprint": "98fc1a72c0c47827", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "marketing-site/src/app/openapi.json/route.ts"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-e6e8f983e6d3331b", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in .github/workflows/agent-loop-dogfood-bot.yml:224"}, "properties": {"repobilityId": "43076696101158bb", "scanner": "scanner-primary", "fingerprint": "e6e8f983e6d3331b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agent-loop-dogfood-bot.yml"}, "region": {"startLine": 224}}}]}, {"ruleId": "scanner-fe8f2685ec118c84", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e4b4ccfc9bf155f7", "scanner": "scanner-primary", "fingerprint": "fe8f2685ec118c84", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "marketing-site/.github/workflows/visual-regression.yml"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-47187cd80d0b0b66", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "80b744e2c6b435f9", "scanner": "scanner-primary", "fingerprint": "47187cd80d0b0b66", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/marketing-site-ci.yml"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-76fc4ebe6275fb44", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9512548e51814f21", "scanner": "scanner-primary", "fingerprint": "76fc4ebe6275fb44", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agent-eval-gatekeeper.yml"}, "region": {"startLine": 224}}}]}, {"ruleId": "scanner-76fc4ebe6275fb44", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "dc64cc450c63ad71", "scanner": "scanner-primary", "fingerprint": "76fc4ebe6275fb44", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agent-eval-gatekeeper.yml"}, "region": {"startLine": 248}}}]}, {"ruleId": "scanner-69d91c030d9c438b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bc8348e653a504fa", "scanner": "scanner-primary", "fingerprint": "69d91c030d9c438b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agent-readme-truth-sentinel.yml"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-69d91c030d9c438b", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "913f9744b0ca74a2", "scanner": "scanner-primary", "fingerprint": "69d91c030d9c438b", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agent-readme-truth-sentinel.yml"}, "region": {"startLine": 45}}}]}, {"ruleId": "scanner-69d91c030d9c438b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5f458828c328f615", "scanner": "scanner-primary", "fingerprint": "69d91c030d9c438b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agent-readme-truth-sentinel.yml"}, "region": {"startLine": 50}}}]}, {"ruleId": "scanner-23742503b49301cf", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "46f24654136a0f14", "scanner": "scanner-primary", "fingerprint": "23742503b49301cf", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agent-release-captain.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1ba5b07ee5ce81be", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1e6e9bd6c312b57d", "scanner": "scanner-primary", "fingerprint": "1ba5b07ee5ce81be", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agent-loop-dogfood-bot.yml"}, "region": {"startLine": 315}}}]}, {"ruleId": "scanner-2ec83b573a5b1bd3", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "76cdd37182a1bdb2", "scanner": "scanner-primary", "fingerprint": "2ec83b573a5b1bd3", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/agent-loop-dogfood-bot.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dc1dcc4d6dae3216", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: scripts/release-captain/package.json"}, "properties": {"repobilityId": "841a235a23686593", "scanner": "scanner-primary", "fingerprint": "dc1dcc4d6dae3216", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/release-captain/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-026cd228dbbea963", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: proof-of-concept/packages/recorder-extension/package.json"}, "properties": {"repobilityId": "b18d7eaa2aa8e254", "scanner": "scanner-primary", "fingerprint": "026cd228dbbea963", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "proof-of-concept/packages/recorder-extension/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9f7d1dbc016a0885", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: proof-of-concept/packages/types/package.json"}, "properties": {"repobilityId": "d2bc1d9ca4103252", "scanner": "scanner-primary", "fingerprint": "9f7d1dbc016a0885", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "proof-of-concept/packages/types/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-227ce86a6089946b", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: proof-of-concept/packages/runner/package.json"}, "properties": {"repobilityId": "8d41468b15b1b6b8", "scanner": "scanner-primary", "fingerprint": "227ce86a6089946b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "proof-of-concept/packages/runner/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6e6ffc6fdca344d0", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: proof-of-concept/packages/recorder/package.json"}, "properties": {"repobilityId": "f8186177cd49cc8a", "scanner": "scanner-primary", "fingerprint": "6e6ffc6fdca344d0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "proof-of-concept/packages/recorder/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-71ff9afe6e3fe3f1", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: proof-of-concept/packages/dashboard/package.json"}, "properties": {"repobilityId": "72764157441e4f20", "scanner": "scanner-primary", "fingerprint": "71ff9afe6e3fe3f1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "proof-of-concept/packages/dashboard/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1581e4769f4c86c5", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: proof-of-concept/packages/adapter-cuit/package.json"}, "properties": {"repobilityId": "ee6ec79841540969", "scanner": "scanner-primary", "fingerprint": "1581e4769f4c86c5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "proof-of-concept/packages/adapter-cuit/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-46c0c8f3f8b4dd9f", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: proof-of-concept/packages/demo-app/package.json"}, "properties": {"repobilityId": "c259616bf2fbef2c", "scanner": "scanner-primary", "fingerprint": "46c0c8f3f8b4dd9f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "proof-of-concept/packages/demo-app/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-00e3373f0a5e4bae", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: proof-of-concept/packages/adapter-jam/package.json"}, "properties": {"repobilityId": "0964303c09631e8f", "scanner": "scanner-primary", "fingerprint": "00e3373f0a5e4bae", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "proof-of-concept/packages/adapter-jam/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2e9511ec34aa1927", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: proof-of-concept/packages/spec-gen/package.json"}, "properties": {"repobilityId": "4e7df74643af687c", "scanner": "scanner-primary", "fingerprint": "2e9511ec34aa1927", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "proof-of-concept/packages/spec-gen/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-947a2495c36fd3f1", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: proof-of-concept/packages/harness/package.json"}, "properties": {"repobilityId": "979d2cbbb3117783", "scanner": "scanner-primary", "fingerprint": "947a2495c36fd3f1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "proof-of-concept/packages/harness/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8bfd79362b04dd44", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: proof-of-concept/packages/mcp-local/package.json"}, "properties": {"repobilityId": "54337087ef077816", "scanner": "scanner-primary", "fingerprint": "8bfd79362b04dd44", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "proof-of-concept/packages/mcp-local/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e9207f9f5cbb591c", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: .github/scripts/eval-runner/package.json"}, "properties": {"repobilityId": "04f37123c5345acf", "scanner": "scanner-primary", "fingerprint": "e9207f9f5cbb591c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/eval-runner/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "f1e011e1d868608b", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "7d121a4fda2d8844", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "658d88af1da2ba3d", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "ae933fe3eee8741e", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "458dffe8cdd2d6c3", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "4e51710934135250", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-a80ee56eec2c2a26", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/cuit-loop/README.md"}, "properties": {"repobilityId": "5dcf10abf62c1e02", "scanner": "scanner-primary", "fingerprint": "a80ee56eec2c2a26", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/cuit-loop/README.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6c766c73ed45098d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/cuit-loop/evals/README.md"}, "properties": {"repobilityId": "522b463596071cfa", "scanner": "scanner-primary", "fingerprint": "6c766c73ed45098d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/cuit-loop/evals/README.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-64fa7705c3daa665", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/cuit-loop/evals/assertions.md"}, "properties": {"repobilityId": "120a3c6ae539abc6", "scanner": "scanner-primary", "fingerprint": "64fa7705c3daa665", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/cuit-loop/evals/assertions.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3afb07bd3501c73c", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/cuit-instrument-workspace/iteration-1/assertions.md"}, "properties": {"repobilityId": "e3ff518a2dcee35a", "scanner": "scanner-primary", "fingerprint": "3afb07bd3501c73c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/cuit-instrument-workspace/iteration-1/assertions.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1d8bb3c565d952da", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/cuit-instrument-workspace/iteration-1/eval-7-almost-trigger-different-skill/with_skill/outputs/decision.md"}, "properties": {"repobilityId": "9303b33564c47efa", "scanner": "scanner-primary", "fingerprint": "1d8bb3c565d952da", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/cuit-instrument-workspace/iteration-1/eval-7-almost-trigger-different-skill/with_skill/outputs/decision.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7627aea26839f4e8", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/cuit-instrument-workspace/iteration-1/eval-7-almost-trigger-different-skill/without_skill/outputs/decision.md"}, "properties": {"repobilityId": "76e7a98cde9b165f", "scanner": "scanner-primary", "fingerprint": "7627aea26839f4e8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/cuit-instrument-workspace/iteration-1/eval-7-almost-trigger-different-skill/without_skill/outputs/decision.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b20cca781fe2494f", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/cuit-instrument-workspace/iteration-1/eval-10-chrome-extension-install-question/with_skill/outputs/decision.md"}, "properties": {"repobilityId": "7388252b2a316f42", "scanner": "scanner-primary", "fingerprint": "b20cca781fe2494f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/cuit-instrument-workspace/iteration-1/eval-10-chrome-extension-install-question/with_skill/outputs/decision.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9c97b52bd9ec9fc9", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/cuit-instrument-workspace/iteration-1/eval-4-with-bug-not-instrument/without_skill/outputs/decision.md"}, "properties": {"repobilityId": "ea8302a1fe14e6eb", "scanner": "scanner-primary", "fingerprint": "9c97b52bd9ec9fc9", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/cuit-instrument-workspace/iteration-1/eval-4-with-bug-not-instrument/without_skill/outputs/decision.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d8eeb0432ff7d00e", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/cuit-instrument/evals/assertions.md"}, "properties": {"repobilityId": "e85e06f995d8bbab", "scanner": "scanner-primary", "fingerprint": "d8eeb0432ff7d00e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/cuit-instrument/evals/assertions.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b8a1bca1916ef014", "level": "none", "message": {"text": "Commented-code block (8 lines) in proof-of-concept/packages/recorder-extension/build.mjs:7"}, "properties": {"repobilityId": "fed2a7ddc49253b3", "scanner": "scanner-primary", "fingerprint": "b8a1bca1916ef014", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e0016f9fdd94daa3", "level": "none", "message": {"text": "Commented-code block (5 lines) in proof-of-concept/packages/recorder-extension/test/extension.test.ts:386"}, "properties": {"repobilityId": "5a8408ed39bcf93f", "scanner": "scanner-primary", "fingerprint": "e0016f9fdd94daa3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-88a8339086a921af", "level": "none", "message": {"text": "Commented-code block (6 lines) in proof-of-concept/packages/recorder-extension/test/build-parity.test.ts:381"}, "properties": {"repobilityId": "7b70051b9c5f03eb", "scanner": "scanner-primary", "fingerprint": "88a8339086a921af", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-414a7bcb0b8a5531", "level": "none", "message": {"text": "Commented-code block (5 lines) in proof-of-concept/packages/recorder-extension/src/content.entry.ts:10"}, "properties": {"repobilityId": "fa12eeabf0596d7a", "scanner": "scanner-primary", "fingerprint": "414a7bcb0b8a5531", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-61a67759905f81ed", "level": "none", "message": {"text": "Commented-code block (9 lines) in proof-of-concept/packages/types/test/console-event.test.ts:267"}, "properties": {"repobilityId": "be59251febeac76f", "scanner": "scanner-primary", "fingerprint": "61a67759905f81ed", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3be7b7a34d074d44", "level": "none", "message": {"text": "Commented-code block (6 lines) in proof-of-concept/packages/runner/test/real-exec.test.ts:551"}, "properties": {"repobilityId": "9e83b2475c39d545", "scanner": "scanner-primary", "fingerprint": "3be7b7a34d074d44", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-72a85a51119b8bc7", "level": "note", "message": {"text": "Legacy-named symbol `executeSpecLegacy` in proof-of-concept/packages/runner/src/index.ts:187"}, "properties": {"repobilityId": "8189206a351cab72", "scanner": "scanner-primary", "fingerprint": "72a85a51119b8bc7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-2cc4976d8801c859", "level": "none", "message": {"text": "Commented-code block (6 lines) in proof-of-concept/packages/dashboard/test/proxy.test.ts:386"}, "properties": {"repobilityId": "f34cbadc7560f2c0", "scanner": "scanner-primary", "fingerprint": "2cc4976d8801c859", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-634b9ce18b5a542a", "level": "none", "message": {"text": "Commented-code block (5 lines) in proof-of-concept/packages/dashboard/test/chat.test.ts:330"}, "properties": {"repobilityId": "58bea19a1b4e5bc8", "scanner": "scanner-primary", "fingerprint": "634b9ce18b5a542a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-01d1a89725e29f40", "level": "none", "message": {"text": "Commented-code block (8 lines) in proof-of-concept/packages/dashboard/test/data.test.ts:39"}, "properties": {"repobilityId": "4cd3e0a598ab61fd", "scanner": "scanner-primary", "fingerprint": "01d1a89725e29f40", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2dbd6a50c13e5fc1", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 proof-of-concept/packages/dashboard/src/chat.ts:269"}, "properties": {"repobilityId": "785c7cfae4ff0676", "scanner": "scanner-primary", "fingerprint": "2dbd6a50c13e5fc1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-8f770000f4f5ac84", "level": "none", "message": {"text": "Commented-code block (7 lines) in proof-of-concept/packages/spec-gen/test/console-signal.test.ts:18"}, "properties": {"repobilityId": "31972380f4d83dab", "scanner": "scanner-primary", "fingerprint": "8f770000f4f5ac84", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-678a6a6365c3cb73", "level": "none", "message": {"text": "Commented-code block (5 lines) in proof-of-concept/packages/spec-gen/src/index.ts:164"}, "properties": {"repobilityId": "6edededc7be81483", "scanner": "scanner-primary", "fingerprint": "678a6a6365c3cb73", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-38e6f52132e51dd8", "level": "none", "message": {"text": "Commented-code block (8 lines) in .github/scripts/eval-runner/run-eval.ts:71"}, "properties": {"repobilityId": "04beb46852cee544", "scanner": "scanner-primary", "fingerprint": "38e6f52132e51dd8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}]}]}