{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-dc554a1a29217fc0", "name": "Stray `console.log` in TS/JS \u2014 cli.ts:742", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 cli.ts:742"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1624eac652d86bdb", "name": "Stray `console.log` in TS/JS \u2014 src/store.ts:722", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/store.ts:722"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5c1364613b56d713", "name": "Stray `console.log` in TS/JS \u2014 src/migrate.ts:95", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/migrate.ts:95"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-660d3ab12a06611e", "name": "Stray `console.log` in TS/JS \u2014 src/smart-extractor.ts:298", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/smart-extractor.ts:298"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4957b027f5b5a823", "name": "TODO/FIXME marker in shipping code \u2014 src/scopes.ts:434", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 src/scopes.ts:434"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-338b8242043d0522", "name": "Stray `console.log` in TS/JS \u2014 src/embedder.ts:598", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/embedder.ts:598"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-09c9108e5ef1c9be", "name": "Insecure pattern 'node_child_process' in index.ts:14", "shortDescription": {"text": "Insecure pattern 'node_child_process' in index.ts:14"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a39c3da13a0fc3ed", "name": "Insecure pattern 'node_child_process' in src/llm-oauth.ts:6", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/llm-oauth.ts:6"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8f4c232b4aa78fc9", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-77166cbd46fcd8e4", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-de53ac274e5b4ecf", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-37716d9c0a33ad5c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ec77845b9113e7fb", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "pozil/auto-assign-issue@v1 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-27924aa79fa4a517", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-235639a5a35179d9", "name": "Very large file: index.ts (5666 lines)", "shortDescription": {"text": "Very large file: index.ts (5666 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-824284252bc6043f", "name": "Very large file: cli.ts (2192 lines)", "shortDescription": {"text": "Very large file: cli.ts (2192 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f65ea309a2ce9b5a", "name": "Very large file: src/tools.ts (2902 lines)", "shortDescription": {"text": "Very large file: src/tools.ts (2902 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d82341cbeee74b18", "name": "Very large file: src/store.ts (2484 lines)", "shortDescription": {"text": "Very large file: src/store.ts (2484 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6a8f0028b786401e", "name": "Very large file: src/smart-extractor.ts (1801 lines)", "shortDescription": {"text": "Very large file: src/smart-extractor.ts (1801 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-224d46e629521b9f", "name": "Very large file: src/retriever.ts (1901 lines)", "shortDescription": {"text": "Very large file: src/retriever.ts (1901 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fa08bdcbf432b3a7", "name": "Very large file: test/smart-extractor-branches.mjs (1997 lines)", "shortDescription": {"text": "Very large file: test/smart-extractor-branches.mjs (1997 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 169 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9d79c4077342a7d0", "name": "Runtime service client appears to use placeholder configuration", "shortDescription": {"text": "Runtime service client appears to use placeholder configuration"}, "fullDescription": {"text": "A runtime source file appears to wire Supabase/Firebase/AI/payment-style clients to placeholder URLs, keys, or fallback values. In the Fable corpus this often means the UI/API shape is present while the backend service is not actually configured."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-50d098fe8a226af0", "name": "Legacy-named symbol `countLegacy` in index.ts:5217", "shortDescription": {"text": "Legacy-named symbol `countLegacy` in index.ts:5217"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a06587bff7f6bd77", "name": "Commented-code block (6 lines) in index.ts:747", "shortDescription": {"text": "Commented-code block (6 lines) in index.ts:747"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-614b14f94f1462e8", "name": "Legacy-named symbol `countLegacy` in cli.ts:1944", "shortDescription": {"text": "Legacy-named symbol `countLegacy` in cli.ts:1944"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-531fa9151f5597f2", "name": "Commented-code block (6 lines) in cli.ts:720", "shortDescription": {"text": "Commented-code block (6 lines) in cli.ts:720"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a6c8e528cc72612e", "name": "Network/subprocess call without timeout or try/except \u2014 restore_files.py:11", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 restore_files.py:11"}, "fullDescription": {"text": "`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d1243297f5080e71", "name": "Commented-code block (5 lines) in scripts/jsonl_distill.py:39", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/jsonl_distill.py:39"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7ce4c1b2c0fb464d", "name": "`fetch()` without try/.catch or AbortSignal \u2014 examples/new-session-distill/worker/lesson-extract-worker.mjs:171", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 examples/new-session-distill/worker/lesson-extract-worker.mjs:171"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9412433836f2d4b3", "name": "Commented-code block (7 lines) in src/tools.ts:1224", "shortDescription": {"text": "Commented-code block (7 lines) in src/tools.ts:1224"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9c807ec8691e6fee", "name": "Legacy-named symbol `isLegacy` in src/store.ts:1787", "shortDescription": {"text": "Legacy-named symbol `isLegacy` in src/store.ts:1787"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bc31b241bb4f1b8a", "name": "Commented-code block (9 lines) in src/store.ts:115", "shortDescription": {"text": "Commented-code block (9 lines) in src/store.ts:115"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-582daf09501e2e8c", "name": "Legacy-named symbol `migrateFromLegacy` in src/migrate.ts:326", "shortDescription": {"text": "Legacy-named symbol `migrateFromLegacy` in src/migrate.ts:326"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea35e89f7f07be0b", "name": "Commented-code block (5 lines) in src/reflection-store.ts:291", "shortDescription": {"text": "Commented-code block (5 lines) in src/reflection-store.ts:291"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f60d2601598fab01", "name": "Legacy-named symbol `pruneOld` in src/smart-extractor.ts:1778", "shortDescription": {"text": "Legacy-named symbol `pruneOld` in src/smart-extractor.ts:1778"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-78233b8dc21a1462", "name": "Commented-code block (8 lines) in src/smart-extractor.ts:92", "shortDescription": {"text": "Commented-code block (8 lines) in src/smart-extractor.ts:92"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4b40e02ae294e04c", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/llm-oauth.ts:409", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/llm-oauth.ts:409"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-29bf6df30c309e02", "name": "Commented-code block (7 lines) in src/smart-metadata.ts:340", "shortDescription": {"text": "Commented-code block (7 lines) in src/smart-metadata.ts:340"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e56ebce58f3af19e", "name": "Commented-code block (5 lines) in src/retriever.ts:1548", "shortDescription": {"text": "Commented-code block (5 lines) in src/retriever.ts:1548"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6510a4e32bcad727", "name": "Legacy-named symbol `totalLegacy` in src/memory-upgrader.ts:43", "shortDescription": {"text": "Legacy-named symbol `totalLegacy` in src/memory-upgrader.ts:43"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c5692e8510187dcb", "name": "Legacy-named symbol `invariantLinesLegacy` in src/reflection-slices.ts:257", "shortDescription": {"text": "Legacy-named symbol `invariantLinesLegacy` in src/reflection-slices.ts:257"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-05b44ca63a3079b5", "name": "Legacy-named symbol `turnLegacy` in src/auto-recall-tier1.ts:90", "shortDescription": {"text": "Legacy-named symbol `turnLegacy` in src/auto-recall-tier1.ts:90"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-de41297dc7c648e0", "name": "Commented-code block (7 lines) in src/auto-recall-tier1.ts:3", "shortDescription": {"text": "Commented-code block (7 lines) in src/auto-recall-tier1.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0aadda8afbdd97c3", "name": "Commented-code block (5 lines) in src/embedder.ts:1016", "shortDescription": {"text": "Commented-code block (5 lines) in src/embedder.ts:1016"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-632bd45e7dc28507", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/embedder.ts:704", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/embedder.ts:704"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-02306c249e433566", "name": "Legacy-named symbol `testReflectionRowsAreNotLegacy` in test/memory-upgrader-diagnostics.test.mjs:19", "shortDescription": {"text": "Legacy-named symbol `testReflectionRowsAreNotLegacy` in test/memory-upgrader-diagnostics.test.mjs:19"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea2b246421b2bac4", "name": "Commented-code block (7 lines) in test/cjk-recursion-regression.test.mjs:276", "shortDescription": {"text": "Commented-code block (7 lines) in test/cjk-recursion-regression.test.mjs:276"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5baad1cec0e3189c", "name": "Legacy-named symbol `acct_old` in test/llm-oauth-client.test.mjs:184", "shortDescription": {"text": "Legacy-named symbol `acct_old` in test/llm-oauth-client.test.mjs:184"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d174be8f1a139e8c", "name": "Commented-code block (5 lines) in test/access-tracker-retry.test.mjs:127", "shortDescription": {"text": "Commented-code block (5 lines) in test/access-tracker-retry.test.mjs:127"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fdc92903bfdb432c", "name": "Commented-code block (7 lines) in test/smart-memory-lifecycle.mjs:220", "shortDescription": {"text": "Commented-code block (7 lines) in test/smart-memory-lifecycle.mjs:220"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ad5b3e9fbc1872d3", "name": "Commented-code block (5 lines) in test/f2-last-background-error.test.mjs:63", "shortDescription": {"text": "Commented-code block (5 lines) in test/f2-last-background-error.test.mjs:63"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-510155431f67cd4c", "name": "Legacy-named symbol `dirOld` in test/regex-fallback-bulk-store.test.mjs:273", "shortDescription": {"text": "Legacy-named symbol `dirOld` in test/regex-fallback-bulk-store.test.mjs:273"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d1a9b3c3d96416f8", "name": "Commented-code block (5 lines) in test/memory-reflection.test.mjs:1031", "shortDescription": {"text": "Commented-code block (5 lines) in test/memory-reflection.test.mjs:1031"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d53c2daec78f05ac", "name": "Commented-code block (5 lines) in test/issue-690-cross-call-batch.test.mjs:404", "shortDescription": {"text": "Commented-code block (5 lines) in test/issue-690-cross-call-batch.test.mjs:404"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a7bd1d7612a9745a", "name": "Legacy-named symbol `updatedOld` in test/is-latest-auto-supersede.test.mjs:162", "shortDescription": {"text": "Legacy-named symbol `updatedOld` in test/is-latest-auto-supersede.test.mjs:162"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4633c541493b1e0f", "name": "Commented-code block (5 lines) in test/smart-extractor-branches.mjs:1351", "shortDescription": {"text": "Commented-code block (5 lines) in test/smart-extractor-branches.mjs:1351"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-85716835ce629b3c", "name": "`fetch()` without try/.catch or AbortSignal \u2014 test/memory-update-metadata-refresh.test.mjs:54", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 test/memory-update-metadata-refresh.test.mjs:54"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a31d3dac85de999d", "name": "Legacy-named symbol `entityOld` in test/memory-update-supersede.test.mjs:294", "shortDescription": {"text": "Legacy-named symbol `entityOld` in test/memory-update-supersede.test.mjs:294"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d2c35e3de174fb5", "name": "Commented-code block (7 lines) in test/memory-reflection-issue680-tdd.test.mjs:362", "shortDescription": {"text": "Commented-code block (7 lines) in test/memory-reflection-issue680-tdd.test.mjs:362"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/25096"}, "properties": {"repository": "CortexReach/memory-lancedb-pro", "repoUrl": "https://github.com/CortexReach/memory-lancedb-pro", "branch": "main"}, "results": [{"ruleId": "scanner-dc554a1a29217fc0", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 cli.ts:742"}, "properties": {"repobilityId": "0f8fdfc588e23fda", "scanner": "scanner-primary", "fingerprint": "dc554a1a29217fc0", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-1624eac652d86bdb", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/store.ts:722"}, "properties": {"repobilityId": "e16f4df3d258a1e3", "scanner": "scanner-primary", "fingerprint": "1624eac652d86bdb", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-5c1364613b56d713", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/migrate.ts:95"}, "properties": {"repobilityId": "2e874475c2e94480", "scanner": "scanner-primary", "fingerprint": "5c1364613b56d713", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-660d3ab12a06611e", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/smart-extractor.ts:298"}, "properties": {"repobilityId": "896260ba60d7a358", "scanner": "scanner-primary", "fingerprint": "660d3ab12a06611e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-4957b027f5b5a823", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 src/scopes.ts:434"}, "properties": {"repobilityId": "9c8cc991a3840377", "scanner": "scanner-primary", "fingerprint": "4957b027f5b5a823", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-338b8242043d0522", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/embedder.ts:598"}, "properties": {"repobilityId": "9fd53efc82ac6a48", "scanner": "scanner-primary", "fingerprint": "338b8242043d0522", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-09c9108e5ef1c9be", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in index.ts:14"}, "properties": {"repobilityId": "618e9a2aaebd6786", "scanner": "scanner-primary", "fingerprint": "09c9108e5ef1c9be", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "index.ts"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-a39c3da13a0fc3ed", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/llm-oauth.ts:6"}, "properties": {"repobilityId": "07e7995beede783e", "scanner": "scanner-primary", "fingerprint": "a39c3da13a0fc3ed", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/llm-oauth.ts"}, "region": {"startLine": 6}}}]}, {"ruleId": "scanner-8f4c232b4aa78fc9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "979e3b58c19faf5e", "scanner": "scanner-primary", "fingerprint": "8f4c232b4aa78fc9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude-code-review.yml"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-8f4c232b4aa78fc9", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7572d8d133564421", "scanner": "scanner-primary", "fingerprint": "8f4c232b4aa78fc9", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude-code-review.yml"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-77166cbd46fcd8e4", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "50f3b563ffac10e9", "scanner": "scanner-primary", "fingerprint": "77166cbd46fcd8e4", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude-code-review.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-de53ac274e5b4ecf", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "02600186fc092bd4", "scanner": "scanner-primary", "fingerprint": "de53ac274e5b4ecf", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude.yml"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-de53ac274e5b4ecf", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8ead6a2c2bfe167b", "scanner": "scanner-primary", "fingerprint": "de53ac274e5b4ecf", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude.yml"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-37716d9c0a33ad5c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "abfb5752158cf655", "scanner": "scanner-primary", "fingerprint": "37716d9c0a33ad5c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ec77845b9113e7fb", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d44ad8518abfc8bd", "scanner": "scanner-primary", "fingerprint": "ec77845b9113e7fb", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/auto-assign.yml"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-ec77845b9113e7fb", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d44ad8518abfc8bd", "scanner": "scanner-primary", "fingerprint": "ec77845b9113e7fb", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/auto-assign.yml"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ae16880318b99912", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 12}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ae16880318b99912", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "989a74409a402368", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ae16880318b99912", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "989a74409a402368", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 49}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ae16880318b99912", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 64}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "989a74409a402368", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 67}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ae16880318b99912", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 82}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "989a74409a402368", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 85}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ae16880318b99912", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 100}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "989a74409a402368", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 103}}}]}, {"ruleId": "scanner-235639a5a35179d9", "level": "note", "message": {"text": "Very large file: index.ts (5666 lines)"}, "properties": {"repobilityId": "195d04da7b5bc324", "scanner": "scanner-primary", "fingerprint": "235639a5a35179d9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-824284252bc6043f", "level": "note", "message": {"text": "Very large file: cli.ts (2192 lines)"}, "properties": {"repobilityId": "1ee25e966af58e8b", "scanner": "scanner-primary", "fingerprint": "824284252bc6043f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f65ea309a2ce9b5a", "level": "note", "message": {"text": "Very large file: src/tools.ts (2902 lines)"}, "properties": {"repobilityId": "f2f5a8c6c6866a11", "scanner": "scanner-primary", "fingerprint": "f65ea309a2ce9b5a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d82341cbeee74b18", "level": "note", "message": {"text": "Very large file: src/store.ts (2484 lines)"}, "properties": {"repobilityId": "5bcf39c9e8def28f", "scanner": "scanner-primary", "fingerprint": "d82341cbeee74b18", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6a8f0028b786401e", "level": "note", "message": {"text": "Very large file: src/smart-extractor.ts (1801 lines)"}, "properties": {"repobilityId": "15559e66784ec77a", "scanner": "scanner-primary", "fingerprint": "6a8f0028b786401e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-224d46e629521b9f", "level": "note", "message": {"text": "Very large file: src/retriever.ts (1901 lines)"}, "properties": {"repobilityId": "959fbe1b0c42559e", "scanner": "scanner-primary", "fingerprint": "224d46e629521b9f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-fa08bdcbf432b3a7", "level": "note", "message": {"text": "Very large file: test/smart-extractor-branches.mjs (1997 lines)"}, "properties": {"repobilityId": "028bef2b72a1109e", "scanner": "scanner-primary", "fingerprint": "fa08bdcbf432b3a7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "8a73c1a9e52a15cf", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "d25f3f5db2f82437", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-9d79c4077342a7d0", "level": "warning", "message": {"text": "Runtime service client appears to use placeholder configuration"}, "properties": {"repobilityId": "f918415b42102962", "scanner": "scanner-primary", "fingerprint": "9d79c4077342a7d0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "runtime-config", "service-client", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "9d16623659e6f18b", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-50d098fe8a226af0", "level": "note", "message": {"text": "Legacy-named symbol `countLegacy` in index.ts:5217"}, "properties": {"repobilityId": "2ec46de0d0e5a285", "scanner": "scanner-primary", "fingerprint": "50d098fe8a226af0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-a06587bff7f6bd77", "level": "none", "message": {"text": "Commented-code block (6 lines) in index.ts:747"}, "properties": {"repobilityId": "736a4f0e68393e22", "scanner": "scanner-primary", "fingerprint": "a06587bff7f6bd77", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-614b14f94f1462e8", "level": "note", "message": {"text": "Legacy-named symbol `countLegacy` in cli.ts:1944"}, "properties": {"repobilityId": "b24466842cf541a4", "scanner": "scanner-primary", "fingerprint": "614b14f94f1462e8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-531fa9151f5597f2", "level": "none", "message": {"text": "Commented-code block (6 lines) in cli.ts:720"}, "properties": {"repobilityId": "656ed88e38b748a7", "scanner": "scanner-primary", "fingerprint": "531fa9151f5597f2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a6c8e528cc72612e", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 restore_files.py:11"}, "properties": {"repobilityId": "de8dfd1bbb5250f7", "scanner": "scanner-primary", "fingerprint": "a6c8e528cc72612e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-d1243297f5080e71", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/jsonl_distill.py:39"}, "properties": {"repobilityId": "459b3a73d6bb7fb0", "scanner": "scanner-primary", "fingerprint": "d1243297f5080e71", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7ce4c1b2c0fb464d", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 examples/new-session-distill/worker/lesson-extract-worker.mjs:171"}, "properties": {"repobilityId": "394f3cd7c6c1d290", "scanner": "scanner-primary", "fingerprint": "7ce4c1b2c0fb464d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-9412433836f2d4b3", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/tools.ts:1224"}, "properties": {"repobilityId": "b69728528dad6d25", "scanner": "scanner-primary", "fingerprint": "9412433836f2d4b3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9c807ec8691e6fee", "level": "note", "message": {"text": "Legacy-named symbol `isLegacy` in src/store.ts:1787"}, "properties": {"repobilityId": "f5ddd9f627440d68", "scanner": "scanner-primary", "fingerprint": "9c807ec8691e6fee", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-bc31b241bb4f1b8a", "level": "none", "message": {"text": "Commented-code block (9 lines) in src/store.ts:115"}, "properties": {"repobilityId": "702d830c4f121f7f", "scanner": "scanner-primary", "fingerprint": "bc31b241bb4f1b8a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-582daf09501e2e8c", "level": "note", "message": {"text": "Legacy-named symbol `migrateFromLegacy` in src/migrate.ts:326"}, "properties": {"repobilityId": "c77eed8b16b626db", "scanner": "scanner-primary", "fingerprint": "582daf09501e2e8c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-ea35e89f7f07be0b", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/reflection-store.ts:291"}, "properties": {"repobilityId": "c04ed52e45dc32c2", "scanner": "scanner-primary", "fingerprint": "ea35e89f7f07be0b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f60d2601598fab01", "level": "note", "message": {"text": "Legacy-named symbol `pruneOld` in src/smart-extractor.ts:1778"}, "properties": {"repobilityId": "7b979df14b413fcc", "scanner": "scanner-primary", "fingerprint": "f60d2601598fab01", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-78233b8dc21a1462", "level": "none", "message": {"text": "Commented-code block (8 lines) in src/smart-extractor.ts:92"}, "properties": {"repobilityId": "fa2afb60c5334100", "scanner": "scanner-primary", "fingerprint": "78233b8dc21a1462", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4b40e02ae294e04c", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/llm-oauth.ts:409"}, "properties": {"repobilityId": "cedd1eaa2cc073d6", "scanner": "scanner-primary", "fingerprint": "4b40e02ae294e04c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-29bf6df30c309e02", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/smart-metadata.ts:340"}, "properties": {"repobilityId": "a3cc3644521578db", "scanner": "scanner-primary", "fingerprint": "29bf6df30c309e02", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e56ebce58f3af19e", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/retriever.ts:1548"}, "properties": {"repobilityId": "272d57dfbafccd7b", "scanner": "scanner-primary", "fingerprint": "e56ebce58f3af19e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6510a4e32bcad727", "level": "note", "message": {"text": "Legacy-named symbol `totalLegacy` in src/memory-upgrader.ts:43"}, "properties": {"repobilityId": "b61fdbe4c57bf044", "scanner": "scanner-primary", "fingerprint": "6510a4e32bcad727", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-c5692e8510187dcb", "level": "note", "message": {"text": "Legacy-named symbol `invariantLinesLegacy` in src/reflection-slices.ts:257"}, "properties": {"repobilityId": "4fdeb01cce52a79e", "scanner": "scanner-primary", "fingerprint": "c5692e8510187dcb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-05b44ca63a3079b5", "level": "note", "message": {"text": "Legacy-named symbol `turnLegacy` in src/auto-recall-tier1.ts:90"}, "properties": {"repobilityId": "0bff6f7ffd254af9", "scanner": "scanner-primary", "fingerprint": "05b44ca63a3079b5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-de41297dc7c648e0", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/auto-recall-tier1.ts:3"}, "properties": {"repobilityId": "704dbd6969327b96", "scanner": "scanner-primary", "fingerprint": "de41297dc7c648e0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0aadda8afbdd97c3", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/embedder.ts:1016"}, "properties": {"repobilityId": "12ece782062fe694", "scanner": "scanner-primary", "fingerprint": "0aadda8afbdd97c3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-632bd45e7dc28507", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/embedder.ts:704"}, "properties": {"repobilityId": "b9800f8bbe1f7cd7", "scanner": "scanner-primary", "fingerprint": "632bd45e7dc28507", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-02306c249e433566", "level": "note", "message": {"text": "Legacy-named symbol `testReflectionRowsAreNotLegacy` in test/memory-upgrader-diagnostics.test.mjs:19"}, "properties": {"repobilityId": "cc6925e6eff6c5aa", "scanner": "scanner-primary", "fingerprint": "02306c249e433566", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-ea2b246421b2bac4", "level": "none", "message": {"text": "Commented-code block (7 lines) in test/cjk-recursion-regression.test.mjs:276"}, "properties": {"repobilityId": "0dc1ea35c6ddd2a5", "scanner": "scanner-primary", "fingerprint": "ea2b246421b2bac4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5baad1cec0e3189c", "level": "note", "message": {"text": "Legacy-named symbol `acct_old` in test/llm-oauth-client.test.mjs:184"}, "properties": {"repobilityId": "d329184bc811108e", "scanner": "scanner-primary", "fingerprint": "5baad1cec0e3189c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-d174be8f1a139e8c", "level": "none", "message": {"text": "Commented-code block (5 lines) in test/access-tracker-retry.test.mjs:127"}, "properties": {"repobilityId": "c2f9e6ad61de419a", "scanner": "scanner-primary", "fingerprint": "d174be8f1a139e8c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fdc92903bfdb432c", "level": "none", "message": {"text": "Commented-code block (7 lines) in test/smart-memory-lifecycle.mjs:220"}, "properties": {"repobilityId": "07d02b3bad08ac7e", "scanner": "scanner-primary", "fingerprint": "fdc92903bfdb432c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ad5b3e9fbc1872d3", "level": "none", "message": {"text": "Commented-code block (5 lines) in test/f2-last-background-error.test.mjs:63"}, "properties": {"repobilityId": "8b3321810042e81a", "scanner": "scanner-primary", "fingerprint": "ad5b3e9fbc1872d3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-510155431f67cd4c", "level": "note", "message": {"text": "Legacy-named symbol `dirOld` in test/regex-fallback-bulk-store.test.mjs:273"}, "properties": {"repobilityId": "ec965054d95d2314", "scanner": "scanner-primary", "fingerprint": "510155431f67cd4c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-d1a9b3c3d96416f8", "level": "none", "message": {"text": "Commented-code block (5 lines) in test/memory-reflection.test.mjs:1031"}, "properties": {"repobilityId": "f25f18e22e73ac1b", "scanner": "scanner-primary", "fingerprint": "d1a9b3c3d96416f8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d53c2daec78f05ac", "level": "none", "message": {"text": "Commented-code block (5 lines) in test/issue-690-cross-call-batch.test.mjs:404"}, "properties": {"repobilityId": "93abbb51deec2ba1", "scanner": "scanner-primary", "fingerprint": "d53c2daec78f05ac", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a7bd1d7612a9745a", "level": "note", "message": {"text": "Legacy-named symbol `updatedOld` in test/is-latest-auto-supersede.test.mjs:162"}, "properties": {"repobilityId": "36c1806fdca962fc", "scanner": "scanner-primary", "fingerprint": "a7bd1d7612a9745a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-4633c541493b1e0f", "level": "none", "message": {"text": "Commented-code block (5 lines) in test/smart-extractor-branches.mjs:1351"}, "properties": {"repobilityId": "3648aa26afe5807a", "scanner": "scanner-primary", "fingerprint": "4633c541493b1e0f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-85716835ce629b3c", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 test/memory-update-metadata-refresh.test.mjs:54"}, "properties": {"repobilityId": "6b8e8e52e8b50577", "scanner": "scanner-primary", "fingerprint": "85716835ce629b3c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-a31d3dac85de999d", "level": "note", "message": {"text": "Legacy-named symbol `entityOld` in test/memory-update-supersede.test.mjs:294"}, "properties": {"repobilityId": "8f3a4100873b5ef2", "scanner": "scanner-primary", "fingerprint": "a31d3dac85de999d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-2d2c35e3de174fb5", "level": "none", "message": {"text": "Commented-code block (7 lines) in test/memory-reflection-issue680-tdd.test.mjs:362"}, "properties": {"repobilityId": "8127e51be1ef9270", "scanner": "scanner-primary", "fingerprint": "2d2c35e3de174fb5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}]}]}