{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-55dcbafcaf5efe0c", "name": "Possibly dead Python function: classify_node", "shortDescription": {"text": "Possibly dead Python function: classify_node"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4793d33a5f115762", "name": "Possibly dead Python function: research_node", "shortDescription": {"text": "Possibly dead Python function: research_node"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f3b438283b7a4a92", "name": "Possibly dead Python function: respond_with_research_node", "shortDescription": {"text": "Possibly dead Python function: respond_with_research_node"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-670cdf75dce4b8da", "name": "Possibly dead Python function: chitchat_node", "shortDescription": {"text": "Possibly dead Python function: chitchat_node"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dafd0e1adc7fd0b5", "name": "Possibly dead Python function: route_after_classify", "shortDescription": {"text": "Possibly dead Python function: route_after_classify"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-12ee1effb720fa65", "name": "Possibly dead Python function: stream_workflow_events", "shortDescription": {"text": "Possibly dead Python function: stream_workflow_events"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-080f804d3a4df5a3", "name": "Possibly dead Python function: safety_hook", "shortDescription": {"text": "Possibly dead Python function: safety_hook"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-35d436ab1e58869b", "name": "Possibly dead Python function: endpoint", "shortDescription": {"text": "Possibly dead Python function: endpoint"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b4595c9664705447", "name": "Possibly dead Python function: pre_stage_hook", "shortDescription": {"text": "Possibly dead Python function: pre_stage_hook"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c6c50e2eadf066b6", "name": "Possibly dead Python function: post_stage_hook", "shortDescription": {"text": "Possibly dead Python function: post_stage_hook"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0d533654b425059a", "name": "Possibly dead Python function: load_for_workflow", "shortDescription": {"text": "Possibly dead Python function: load_for_workflow"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e066691601852931", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b43f0638a3ae0cd6", "name": "Dockerfile runs as root: templates/langgraph-sidecar/bot/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: templates/langgraph-sidecar/bot/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f68f884051b803e4", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ed5deb475aac83f6", "name": "Insecure pattern 'subprocess_shell_true' in armature/nodes/script.py:30", "shortDescription": {"text": "Insecure pattern 'subprocess_shell_true' in armature/nodes/script.py:30"}, "fullDescription": {"text": "Found a known-risky pattern (subprocess_shell_true). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8c4b183730dd8d09", "name": "Insecure pattern 'subprocess_shell_true' in armature/registry/builtins.py:23", "shortDescription": {"text": "Insecure pattern 'subprocess_shell_true' in armature/registry/builtins.py:23"}, "fullDescription": {"text": "Found a known-risky pattern (subprocess_shell_true). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a53bf972e19b52fd", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-python@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7ffa33751be3d771", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-27924aa79fa4a517", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-python@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-24ee899c773e61aa", "name": "Very large file: tests/synthesis/test_improve.py (1406 lines)", "shortDescription": {"text": "Very large file: tests/synthesis/test_improve.py (1406 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-976344ebac0d18c1", "name": "Very large file: armature/cli.py (1330 lines)", "shortDescription": {"text": "Very large file: armature/cli.py (1330 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 30 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e725d2ab884fbd49", "name": "Multiple root agent instruction files without precedence", "shortDescription": {"text": "Multiple root agent instruction files without precedence"}, "fullDescription": {"text": "The repo has multiple top-level AI-coder instruction files. Without precedence rules, different agents may follow different policies."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e5f4c5ffc22ae1e6", "name": "Legacy-named symbol `model_copy` in tests/runtime/test_engine.py:60", "shortDescription": {"text": "Legacy-named symbol `model_copy` in tests/runtime/test_engine.py:60"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8fb45f9e5bb703e4", "name": "Legacy-named symbol `test_messages_returns_copy` in tests/runtime/test_context.py:32", "shortDescription": {"text": "Legacy-named symbol `test_messages_returns_copy` in tests/runtime/test_context.py:32"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6b781e0ac9a33c68", "name": "Network/subprocess call without timeout or try/except \u2014 armature/demo.py:162", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 armature/demo.py:162"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9601eb3a2e34d6ca", "name": "Legacy-named symbol `model_copy` in armature/optimizer/runner.py:210", "shortDescription": {"text": "Legacy-named symbol `model_copy` in armature/optimizer/runner.py:210"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a9c9785590799270", "name": "Stub function `set_attribute` (body is just `pass`/`return`) \u2014 armature/telemetry/__init__.py:74", "shortDescription": {"text": "Stub function `set_attribute` (body is just `pass`/`return`) \u2014 armature/telemetry/__init__.py:74"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8e047ab7af03962f", "name": "7 env vars used in code but missing from .env.example", "shortDescription": {"text": "7 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `ARMATURE_URL`, `LANGFUSE_HOST`, `LANGFUSE_PUBLIC_KEY`, `LANGFUSE_SECRET_KEY`, `LANGSMITH_API_KEY`, `LANGSMITH_PROJECT`, `OLLAMA_API_KEY`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\narmature/cli.py:export_traces, armature/cli.py:export\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\narmature/sandbox/docker.py:handler, armature/sandbox/docker.py:handler, armature/sandbox/docker.py:handler\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/24740"}, "properties": {"repository": "bryansparks/armature", "repoUrl": "https://github.com/bryansparks/armature", "branch": "main"}, "results": [{"ruleId": "scanner-55dcbafcaf5efe0c", "level": "note", "message": {"text": "Possibly dead Python function: classify_node"}, "properties": {"repobilityId": "052d484fcabdcc41", "scanner": "scanner-primary", "fingerprint": "55dcbafcaf5efe0c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/langgraph-sidecar/bot/nodes.py:13"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4793d33a5f115762", "level": "note", "message": {"text": "Possibly dead Python function: research_node"}, "properties": {"repobilityId": "f12852465323223f", "scanner": "scanner-primary", "fingerprint": "4793d33a5f115762", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/langgraph-sidecar/bot/nodes.py:30"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f3b438283b7a4a92", "level": "note", "message": {"text": "Possibly dead Python function: respond_with_research_node"}, "properties": {"repobilityId": "fcf1fc576df1eb05", "scanner": "scanner-primary", "fingerprint": "f3b438283b7a4a92", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/langgraph-sidecar/bot/nodes.py:46"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-670cdf75dce4b8da", "level": "note", "message": {"text": "Possibly dead Python function: chitchat_node"}, "properties": {"repobilityId": "0db36baa783b1c50", "scanner": "scanner-primary", "fingerprint": "670cdf75dce4b8da", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/langgraph-sidecar/bot/nodes.py:66"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dafd0e1adc7fd0b5", "level": "note", "message": {"text": "Possibly dead Python function: route_after_classify"}, "properties": {"repobilityId": "a6ff1ee941ad35d9", "scanner": "scanner-primary", "fingerprint": "dafd0e1adc7fd0b5", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/langgraph-sidecar/bot/nodes.py:74"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-12ee1effb720fa65", "level": "note", "message": {"text": "Possibly dead Python function: stream_workflow_events"}, "properties": {"repobilityId": "766d641496f98d67", "scanner": "scanner-primary", "fingerprint": "12ee1effb720fa65", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/langgraph-sidecar/bot/armature_client.py:39"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-080f804d3a4df5a3", "level": "note", "message": {"text": "Possibly dead Python function: safety_hook"}, "properties": {"repobilityId": "8cef660fed2873f4", "scanner": "scanner-primary", "fingerprint": "080f804d3a4df5a3", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "armature/hooks/lifecycle.py:120"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-35d436ab1e58869b", "level": "note", "message": {"text": "Possibly dead Python function: endpoint"}, "properties": {"repobilityId": "bfa802f50bf07c97", "scanner": "scanner-primary", "fingerprint": "35d436ab1e58869b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "armature/service/triggers.py:74"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b4595c9664705447", "level": "note", "message": {"text": "Possibly dead Python function: pre_stage_hook"}, "properties": {"repobilityId": "76574ed22516bd19", "scanner": "scanner-primary", "fingerprint": "b4595c9664705447", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "armature/service/app.py:162"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c6c50e2eadf066b6", "level": "note", "message": {"text": "Possibly dead Python function: post_stage_hook"}, "properties": {"repobilityId": "5211b40e1fbbe635", "scanner": "scanner-primary", "fingerprint": "c6c50e2eadf066b6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "armature/service/app.py:166"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0d533654b425059a", "level": "note", "message": {"text": "Possibly dead Python function: load_for_workflow"}, "properties": {"repobilityId": "abe7b8d85dd0dfe9", "scanner": "scanner-primary", "fingerprint": "0d533654b425059a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "armature/state/evaluator.py:81"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e066691601852931", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "57e591f3824a82c8", "scanner": "scanner-primary", "fingerprint": "e066691601852931", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-b43f0638a3ae0cd6", "level": "warning", "message": {"text": "Dockerfile runs as root: templates/langgraph-sidecar/bot/Dockerfile"}, "properties": {"repobilityId": "3c784c32061886a5", "scanner": "scanner-primary", "fingerprint": "b43f0638a3ae0cd6", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-f68f884051b803e4", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "e1dd04cd2d751182", "scanner": "scanner-primary", "fingerprint": "f68f884051b803e4", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "templates/langgraph-sidecar/bot/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ed5deb475aac83f6", "level": "error", "message": {"text": "Insecure pattern 'subprocess_shell_true' in armature/nodes/script.py:30"}, "properties": {"repobilityId": "fa6bd6d687927038", "scanner": "scanner-primary", "fingerprint": "ed5deb475aac83f6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "subprocess_shell_true"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "armature/nodes/script.py"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-8c4b183730dd8d09", "level": "error", "message": {"text": "Insecure pattern 'subprocess_shell_true' in armature/registry/builtins.py:23"}, "properties": {"repobilityId": "8c70bd0cb60722f5", "scanner": "scanner-primary", "fingerprint": "8c4b183730dd8d09", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "subprocess_shell_true"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "armature/registry/builtins.py"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-a53bf972e19b52fd", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0fde4c5793055812", "scanner": "scanner-primary", "fingerprint": "a53bf972e19b52fd", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish.yml"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-a53bf972e19b52fd", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "26eca5024249c767", "scanner": "scanner-primary", "fingerprint": "a53bf972e19b52fd", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish.yml"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-7ffa33751be3d771", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "491a3ad29cbaf189", "scanner": "scanner-primary", "fingerprint": "7ffa33751be3d771", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "04f57d208548fcef", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-24ee899c773e61aa", "level": "note", "message": {"text": "Very large file: tests/synthesis/test_improve.py (1406 lines)"}, "properties": {"repobilityId": "b94a2ad9e0a7b073", "scanner": "scanner-primary", "fingerprint": "24ee899c773e61aa", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-976344ebac0d18c1", "level": "note", "message": {"text": "Very large file: armature/cli.py (1330 lines)"}, "properties": {"repobilityId": "9dfc46306e0db7d1", "scanner": "scanner-primary", "fingerprint": "976344ebac0d18c1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "c737e19e845975c4", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "e723013b0d8b9ee7", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-e725d2ab884fbd49", "level": "note", "message": {"text": "Multiple root agent instruction files without precedence"}, "properties": {"repobilityId": "1953db6c89508d22", "scanner": "scanner-primary", "fingerprint": "e725d2ab884fbd49", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["agent-instructions", "governance"]}}, {"ruleId": "scanner-e5f4c5ffc22ae1e6", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in tests/runtime/test_engine.py:60"}, "properties": {"repobilityId": "5908826ee6f0ecbf", "scanner": "scanner-primary", "fingerprint": "e5f4c5ffc22ae1e6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-8fb45f9e5bb703e4", "level": "note", "message": {"text": "Legacy-named symbol `test_messages_returns_copy` in tests/runtime/test_context.py:32"}, "properties": {"repobilityId": "e44d774ed06c12e9", "scanner": "scanner-primary", "fingerprint": "8fb45f9e5bb703e4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-6b781e0ac9a33c68", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 armature/demo.py:162"}, "properties": {"repobilityId": "5df823d3adb79e9a", "scanner": "scanner-primary", "fingerprint": "6b781e0ac9a33c68", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-9601eb3a2e34d6ca", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in armature/optimizer/runner.py:210"}, "properties": {"repobilityId": "a2bf4eedb72a3b88", "scanner": "scanner-primary", "fingerprint": "9601eb3a2e34d6ca", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-a9c9785590799270", "level": "note", "message": {"text": "Stub function `set_attribute` (body is just `pass`/`return`) \u2014 armature/telemetry/__init__.py:74"}, "properties": {"repobilityId": "8962851b6787383d", "scanner": "scanner-primary", "fingerprint": "a9c9785590799270", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-8e047ab7af03962f", "level": "note", "message": {"text": "7 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "5a0455f6498c27ad", "scanner": "scanner-primary", "fingerprint": "8e047ab7af03962f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "aca69d755d518e4d", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "aa24f5cb93900a69", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "697f17cac01adffd", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "88904971d5dffe86", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "42475006ac51b50a", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "345ede5e74dcf601", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "ce2fbe706bba20ac", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}]}]}