{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-cc631d7093a501d0", "name": "Possibly dead Python function: parse_when2call_tool_calls", "shortDescription": {"text": "Possibly dead Python function: parse_when2call_tool_calls"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5cf8a4b2051b33c7", "name": "Possibly dead Python function: forward", "shortDescription": {"text": "Possibly dead Python function: forward"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a758c44525c07c4b", "name": "Possibly dead Python function: system_ram_gb", "shortDescription": {"text": "Possibly dead Python function: system_ram_gb"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1d2cc34ce624fc65", "name": "Possibly dead Python function: loss_fn", "shortDescription": {"text": "Possibly dead Python function: loss_fn"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dbf2d183211a051a", "name": "Possibly dead Python function: loss_fn", "shortDescription": {"text": "Possibly dead Python function: loss_fn"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0c301f0b27921d1b", "name": "Possibly dead Python function: log_message", "shortDescription": {"text": "Possibly dead Python function: log_message"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f12123355477184f", "name": "Possibly dead Python function: do_GET", "shortDescription": {"text": "Possibly dead Python function: do_GET"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-932faea225881d47", "name": "Possibly dead Python function: score_metric", "shortDescription": {"text": "Possibly dead Python function: score_metric"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-623590b1a56d73ef", "name": "Possibly dead Python function: memory_import", "shortDescription": {"text": "Possibly dead Python function: memory_import"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-25787c5e9a7e4533", "name": "Possibly dead Python function: wait_and_approve", "shortDescription": {"text": "Possibly dead Python function: wait_and_approve"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8fcba18b2ef9f8b3", "name": "Possible secret in legacy/rust-core/src/fae_llm/observability/README.md", "shortDescription": {"text": "Possible secret in legacy/rust-core/src/fae_llm/observability/README.md"}, "fullDescription": {"text": "Detected pattern matching openai_or_anthropic_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-09fb39226594bf2f", "name": "Possible secret in legacy/rust-core/src/fae_llm/observability/redact.rs", "shortDescription": {"text": "Possible secret in legacy/rust-core/src/fae_llm/observability/redact.rs"}, "fullDescription": {"text": "Detected pattern matching openai_or_anthropic_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-6ee58f9f203e43ca", "name": "Insecure pattern 'document_write' in native/rust/fae-ui-shell/src/main.rs:1300", "shortDescription": {"text": "Insecure pattern 'document_write' in native/rust/fae-ui-shell/src/main.rs:1300"}, "fullDescription": {"text": "Found a known-risky pattern (document_write). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c2ed218b5bdb07d1", "name": "Insecure pattern 'cors_wildcard' in native/macos/Fae/Sources/Fae/Resources/Skills/mesh/scripts/serve.py:56", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in native/macos/Fae/Sources/Fae/Resources/Skills/mesh/scripts/serve.py:56"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-42ae671e2a3a9e89", "name": "Possible secret in native/macos/Fae/Sources/Fae/Resources/Skills/connect-account/scripts/connect_account.py", "shortDescription": {"text": "Possible secret in native/macos/Fae/Sources/Fae/Resources/Skills/connect-account/scripts/connect_account.py"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-b0cdc06c1b472f1b", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "dtolnay/rust-toolchain@stable can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-46c644c6227e4d4a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "dtolnay/rust-toolchain@stable can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e92d31b3cc69227a", "name": "Very large file: scripts/test-comprehensive.sh (1649 lines)", "shortDescription": {"text": "Very large file: scripts/test-comprehensive.sh (1649 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ae5c64e1396bdd80", "name": "Very large file: legacy/rust-core/src/config.rs (2292 lines)", "shortDescription": {"text": "Very large file: legacy/rust-core/src/config.rs (2292 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b836588ac8bc9487", "name": "Very large file: legacy/rust-core/src/host/channel.rs (2197 lines)", "shortDescription": {"text": "Very large file: legacy/rust-core/src/host/channel.rs (2197 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-52fce887393ab584", "name": "Very large file: legacy/rust-core/src/host/handler.rs (4344 lines)", "shortDescription": {"text": "Very large file: legacy/rust-core/src/host/handler.rs (4344 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a1333c257cf3c5ad", "name": "Very large file: legacy/rust-core/src/agent/mod.rs (1523 lines)", "shortDescription": {"text": "Very large file: legacy/rust-core/src/agent/mod.rs (1523 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-91a2dbfb43cdbf9e", "name": "Very large file: legacy/rust-core/src/fae_llm/agent/loop_engine.rs (1646 lines)", "shortDescription": {"text": "Very large file: legacy/rust-core/src/fae_llm/agent/loop_engine.rs (1646 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-692d002ec86114fa", "name": "Very large file: legacy/rust-core/src/fae_llm/tools/apple/applescript.rs (1379 lines)", "shortDescription": {"text": "Very large file: legacy/rust-core/src/fae_llm/tools/apple/applescript.rs (1379 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1907d83073dc49cb", "name": "Very large file: legacy/rust-core/src/memory/jsonl.rs (2923 lines)", "shortDescription": {"text": "Very large file: legacy/rust-core/src/memory/jsonl.rs (2923 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-578c2d38295720e4", "name": "Very large file: legacy/rust-core/src/memory/sqlite.rs (1779 lines)", "shortDescription": {"text": "Very large file: legacy/rust-core/src/memory/sqlite.rs (1779 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-361b762950ca4c8e", "name": "Very large file: legacy/rust-core/src/pipeline/coordinator.rs (5192 lines)", "shortDescription": {"text": "Very large file: legacy/rust-core/src/pipeline/coordinator.rs (5192 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-89dedcf48c1ac191", "name": "Very large file: legacy/rust-core/src/skills/python_runner.rs (1837 lines)", "shortDescription": {"text": "Very large file: legacy/rust-core/src/skills/python_runner.rs (1837 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-89d5cbbc5836afdc", "name": "Very large file: legacy/rust-core/src/scheduler/tasks.rs (1647 lines)", "shortDescription": {"text": "Very large file: legacy/rust-core/src/scheduler/tasks.rs (1647 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-128256353b318fa6", "name": "Very large file: native/rust/fae-ui-shell/src/main.rs (1914 lines)", "shortDescription": {"text": "Very large file: native/rust/fae-ui-shell/src/main.rs (1914 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "53 tests / 353 src (ratio 0.15)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 755 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 181 placeholder/mock markers across 50 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-640e568063487946", "name": "Agent instruction/config may expose a secret: native/macos/Fae/Sources/Fae/Resources/Skills/secure-input/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: native/macos/Fae/Sources/Fae/Resources/Skills/secure-input/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-eff9534cc2c22bfa", "name": "Agent authority lacks a verifier contract: native/macos/Fae/Sources/Fae/Resources/Skills/focus-defender/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: native/macos/Fae/Sources/Fae/Resources/Skills/focus-defender/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f156e2f2a7a874b7", "name": "Agent authority lacks a verifier contract: native/macos/Fae/Sources/Fae/Resources/Skills/system-health/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: native/macos/Fae/Sources/Fae/Resources/Skills/system-health/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9314fb82a0b137b6", "name": "Agent authority lacks a verifier contract: native/macos/Fae/Sources/Fae/Resources/Skills/capability-discovery/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: native/macos/Fae/Sources/Fae/Resources/Skills/capability-discovery/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9a65fd1b63a14af0", "name": "Agent authority lacks a verifier contract: native/macos/Fae/Sources/Fae/Resources/Skills/file-organizer/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: native/macos/Fae/Sources/Fae/Resources/Skills/file-organizer/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6da77c13142719b6", "name": "Agent authority lacks a verifier contract: native/macos/Fae/Sources/Fae/Resources/Skills/document-analyst/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: native/macos/Fae/Sources/Fae/Resources/Skills/document-analyst/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7197ef672fd88a2b", "name": "Agent instruction contains unpinned remote install: native/macos/Fae/Sources/Fae/Resources/Skills/acp-setup/SKILL.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: native/macos/Fae/Sources/Fae/Resources/Skills/acp-setup/SKILL.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea9ef96729a95bef", "name": "Agent instruction/config may expose a secret: native/macos/Fae/Sources/Fae/Resources/Skills/connect-account/SKILL.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: native/macos/Fae/Sources/Fae/Resources/Skills/connect-account/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b8bb703b63d00919", "name": "Agent authority lacks a verifier contract: Skills/apple-ecosystem/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: Skills/apple-ecosystem/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d35f177ee2db5c05", "name": "Agent authority lacks a verifier contract: Skills/packages/native-device-handoff/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: Skills/packages/native-device-handoff/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fb979aeefbb695c2", "name": "Agent authority lacks a verifier contract: Skills/uv-scripts/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: Skills/uv-scripts/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e725d2ab884fbd49", "name": "Multiple root agent instruction files without precedence", "shortDescription": {"text": "Multiple root agent instruction files without precedence"}, "fullDescription": {"text": "The repo has multiple top-level AI-coder instruction files. Without precedence rules, different agents may follow different policies."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-32a78087f4ad1212", "name": "Commented-code block (8 lines) in scripts/hf_jobs_merge_peft_adapter.py:2", "shortDescription": {"text": "Commented-code block (8 lines) in scripts/hf_jobs_merge_peft_adapter.py:2"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-03e1f9879469142d", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/convert_speaker_model.py:103", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/convert_speaker_model.py:103"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-88d33de668790e5e", "name": "Commented-code block (11 lines) in scripts/hf_jobs_train_orpo.py:2", "shortDescription": {"text": "Commented-code block (11 lines) in scripts/hf_jobs_train_orpo.py:2"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1318052b26dc1803", "name": "Commented-code block (11 lines) in scripts/hf_jobs_train_sft.py:2", "shortDescription": {"text": "Commented-code block (11 lines) in scripts/hf_jobs_train_sft.py:2"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-09c8c0eda62c3f88", "name": "Commented-code block (5 lines) in scripts/benchmark_qwen36.py:44", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/benchmark_qwen36.py:44"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6cc5cb28b4068c2c", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/convert-classifier-to-coreml.py:136", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/convert-classifier-to-coreml.py:136"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-66792a09a436261c", "name": "Commented-code block (6 lines) in native/macos/Fae/Sources/Fae/Resources/Scripts/kokoro_tts_server.py:2", "shortDescription": {"text": "Commented-code block (6 lines) in native/macos/Fae/Sources/Fae/Resources/Scripts/kokoro_tts_server.py:2"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f569298568e77b79", "name": "Network/subprocess call without timeout or try/except \u2014 native/macos/Fae/Sources/Fae/Resources/Skills/training-orchestra", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 native/macos/Fae/Sources/Fae/Resources/Skills/training-orchestrator/scripts/train.py:183"}, "fullDescription": {"text": "`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f74bbb9632894120", "name": "Network/subprocess call without timeout or try/except \u2014 native/macos/Fae/Sources/Fae/Resources/Skills/training-orchestra", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 native/macos/Fae/Sources/Fae/Resources/Skills/training-orchestrator/scripts/train_dpo.py:157"}, "fullDescription": {"text": "`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3a575466e5f23a18", "name": "Network/subprocess call without timeout or try/except \u2014 native/macos/Fae/Sources/Fae/Resources/Skills/training-orchestra", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 native/macos/Fae/Sources/Fae/Resources/Skills/training-orchestrator/scripts/train_stt.py:191"}, "fullDescription": {"text": "`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7138048fefe19bdd", "name": "Network/subprocess call without timeout or try/except \u2014 native/macos/Fae/Sources/Fae/Resources/Skills/forge/scripts/init", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 native/macos/Fae/Sources/Fae/Resources/Skills/forge/scripts/init.py:245"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-47495ce5b942cfff", "name": "Network/subprocess call without timeout or try/except \u2014 native/macos/Fae/Sources/Fae/Resources/Skills/forge/scripts/rele", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 native/macos/Fae/Sources/Fae/Resources/Skills/forge/scripts/release.py:424"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7fe4c1995362d693", "name": "Network/subprocess call without timeout or try/except \u2014 native/macos/Fae/Sources/Fae/Resources/Skills/training-data-brid", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 native/macos/Fae/Sources/Fae/Resources/Skills/training-data-bridge/scripts/prepare_keyword_data.py:212"}, "fullDescription": {"text": "`urllib.request.urlretrieve(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-30d31d7b076dac9c", "name": "Commented-code block (5 lines) in native/macos/Fae/Sources/Fae/Resources/Skills/connect-account/scripts/connect_account.", "shortDescription": {"text": "Commented-code block (5 lines) in native/macos/Fae/Sources/Fae/Resources/Skills/connect-account/scripts/connect_account.py:102"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7b64f1e26731b4bc", "name": "Network/subprocess call without timeout or try/except \u2014 native/macos/Fae/autoresearch/asr_generate_corpus.py:70", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 native/macos/Fae/autoresearch/asr_generate_corpus.py:70"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-408a176f0382bd3e", "name": "Commented-code block (5 lines) in native/macos/Fae/autoresearch/interactive.py:176", "shortDescription": {"text": "Commented-code block (5 lines) in native/macos/Fae/autoresearch/interactive.py:176"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-120d62dc91002969", "name": "Network/subprocess call without timeout or try/except \u2014 native/macos/Fae/autoresearch/interactive.py:99", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 native/macos/Fae/autoresearch/interactive.py:99"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nscripts/import_hf_lane_data.py:truncate, scripts/import_public_preference_data.py:truncate\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nscripts/import_hf_lane_data.py:write_jsonl, scripts/import_public_preference_data.py:write_jsonl, scripts/generate_surgical_lane_data.py:write_jsonl\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49c98f7cedd9c977", "name": "Near-duplicate function bodies in 4 places", "shortDescription": {"text": "Near-duplicate function bodies in 4 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nscripts/hf_jobs_merge_peft_adapter.py:resolve_token, scripts/upload_training_data_to_hf.py:resolve_token, scripts/hf_jobs_train_orpo.py:resolve_token, scripts/hf_jobs_train_sft.py:resolve_token\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72995c322c5d8284", "name": "FastAPI POST `api_start_run` without auth dependency \u2014 eval/server.py:124", "shortDescription": {"text": "FastAPI POST `api_start_run` without auth dependency \u2014 eval/server.py:124"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4fe822f93cdd90e0", "name": "FastAPI POST `api_compare` without auth dependency \u2014 eval/server.py:194", "shortDescription": {"text": "FastAPI POST `api_compare` without auth dependency \u2014 eval/server.py:194"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`eval/server.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e9677a42209126dc", "name": "Unused endpoint: GET /run/{run_id}", "shortDescription": {"text": "Unused endpoint: GET /run/{run_id}"}, "fullDescription": {"text": "`eval/server.py` declares `GET /run/{run_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-18a4887e7bea6b36", "name": "Unused endpoint: GET /compare", "shortDescription": {"text": "Unused endpoint: GET /compare"}, "fullDescription": {"text": "`eval/server.py` declares `GET /compare` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-98248ada9c474560", "name": "Unused endpoint: GET /api/hardware", "shortDescription": {"text": "Unused endpoint: GET /api/hardware"}, "fullDescription": {"text": "`eval/server.py` declares `GET /api/hardware` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f204253066a1fb71", "name": "Unused endpoint: GET /api/scenarios", "shortDescription": {"text": "Unused endpoint: GET /api/scenarios"}, "fullDescription": {"text": "`eval/server.py` declares `GET /api/scenarios` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ca0ee8c086b37844", "name": "Unused endpoint: GET /api/runs", "shortDescription": {"text": "Unused endpoint: GET /api/runs"}, "fullDescription": {"text": "`eval/server.py` declares `GET /api/runs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b35612e89f90d626", "name": "Unused endpoint: GET /api/runs/{run_id}", "shortDescription": {"text": "Unused endpoint: GET /api/runs/{run_id}"}, "fullDescription": {"text": "`eval/server.py` declares `GET /api/runs/{run_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4088623aa3fbe46f", "name": "Unused endpoint: GET /api/longitudinal/{model_id}", "shortDescription": {"text": "Unused endpoint: GET /api/longitudinal/{model_id}"}, "fullDescription": {"text": "`eval/server.py` declares `GET /api/longitudinal/{model_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-83f363da8e954ea8", "name": "Unused endpoint: POST /api/run", "shortDescription": {"text": "Unused endpoint: POST /api/run"}, "fullDescription": {"text": "`eval/server.py` declares `POST /api/run` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d82cc471afad2ab8", "name": "Unused endpoint: GET /api/stream/{run_id}", "shortDescription": {"text": "Unused endpoint: GET /api/stream/{run_id}"}, "fullDescription": {"text": "`eval/server.py` declares `GET /api/stream/{run_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c4221670861e52f0", "name": "Unused endpoint: POST /api/compare", "shortDescription": {"text": "Unused endpoint: POST /api/compare"}, "fullDescription": {"text": "`eval/server.py` declares `POST /api/compare` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/19048"}, "properties": {"repository": "saorsa-labs/fae", "repoUrl": "https://github.com/saorsa-labs/fae", "branch": "main"}, "results": [{"ruleId": "scanner-cc631d7093a501d0", "level": "note", "message": {"text": "Possibly dead Python function: parse_when2call_tool_calls"}, "properties": {"repobilityId": "b49c2026b3aaa41a", "scanner": "scanner-primary", "fingerprint": "cc631d7093a501d0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/import_hf_lane_data.py:413"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5cf8a4b2051b33c7", "level": "note", "message": {"text": "Possibly dead Python function: forward"}, "properties": {"repobilityId": "ea414cce7f8e5874", "scanner": "scanner-primary", "fingerprint": "5cf8a4b2051b33c7", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/convert-classifier-to-coreml.py:37"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a758c44525c07c4b", "level": "note", "message": {"text": "Possibly dead Python function: system_ram_gb"}, "properties": {"repobilityId": "4273b5bf51457e53", "scanner": "scanner-primary", "fingerprint": "a758c44525c07c4b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/benchmark_gemma4.py:360"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1d2cc34ce624fc65", "level": "note", "message": {"text": "Possibly dead Python function: loss_fn"}, "properties": {"repobilityId": "6e2b105b0c705a4b", "scanner": "scanner-primary", "fingerprint": "1d2cc34ce624fc65", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "native/macos/Fae/Sources/Fae/Resources/Skills/training-orchestrator/scripts/train_speech_verifier.py:169"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dbf2d183211a051a", "level": "note", "message": {"text": "Possibly dead Python function: loss_fn"}, "properties": {"repobilityId": "6e2b105b0c705a4b", "scanner": "scanner-primary", "fingerprint": "dbf2d183211a051a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "native/macos/Fae/Sources/Fae/Resources/Skills/training-orchestrator/scripts/train_keyword.py:173"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0c301f0b27921d1b", "level": "note", "message": {"text": "Possibly dead Python function: log_message"}, "properties": {"repobilityId": "965f3150b4af5b2e", "scanner": "scanner-primary", "fingerprint": "0c301f0b27921d1b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "native/macos/Fae/Sources/Fae/Resources/Skills/mesh/scripts/serve.py:47"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f12123355477184f", "level": "note", "message": {"text": "Possibly dead Python function: do_GET"}, "properties": {"repobilityId": "2d943bb45e4f13bd", "scanner": "scanner-primary", "fingerprint": "f12123355477184f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "native/macos/Fae/Sources/Fae/Resources/Skills/mesh/scripts/serve.py:72"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-932faea225881d47", "level": "note", "message": {"text": "Possibly dead Python function: score_metric"}, "properties": {"repobilityId": "d59184dd6d080d4f", "scanner": "scanner-primary", "fingerprint": "932faea225881d47", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "native/macos/Fae/autoresearch/update_state.py:48"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-623590b1a56d73ef", "level": "note", "message": {"text": "Possibly dead Python function: memory_import"}, "properties": {"repobilityId": "0bef40708dc9cf26", "scanner": "scanner-primary", "fingerprint": "623590b1a56d73ef", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "native/macos/Fae/autoresearch/runners/inject_runner.py:105"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-25787c5e9a7e4533", "level": "note", "message": {"text": "Possibly dead Python function: wait_and_approve"}, "properties": {"repobilityId": "114408ef9066ee15", "scanner": "scanner-primary", "fingerprint": "25787c5e9a7e4533", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "native/macos/Fae/autoresearch/runners/inject_runner.py:155"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-8fcba18b2ef9f8b3", "level": "error", "message": {"text": "Possible secret in legacy/rust-core/src/fae_llm/observability/README.md"}, "properties": {"repobilityId": "beb5ea5a002a073d", "scanner": "scanner-primary", "fingerprint": "8fcba18b2ef9f8b3", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "legacy/rust-core/src/fae_llm/observability/README.md"}, "region": {"startLine": 190}}}]}, {"ruleId": "scanner-8fcba18b2ef9f8b3", "level": "error", "message": {"text": "Possible secret in legacy/rust-core/src/fae_llm/observability/README.md"}, "properties": {"repobilityId": "beb5ea5a002a073d", "scanner": "scanner-primary", "fingerprint": "8fcba18b2ef9f8b3", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "legacy/rust-core/src/fae_llm/observability/README.md"}, "region": {"startLine": 205}}}]}, {"ruleId": "scanner-09fb39226594bf2f", "level": "error", "message": {"text": "Possible secret in legacy/rust-core/src/fae_llm/observability/redact.rs"}, "properties": {"repobilityId": "de8ad72124f45e47", "scanner": "scanner-primary", "fingerprint": "09fb39226594bf2f", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "legacy/rust-core/src/fae_llm/observability/redact.rs"}, "region": {"startLine": 89}}}]}, {"ruleId": "scanner-09fb39226594bf2f", "level": "error", "message": {"text": "Possible secret in legacy/rust-core/src/fae_llm/observability/redact.rs"}, "properties": {"repobilityId": "de8ad72124f45e47", "scanner": "scanner-primary", "fingerprint": "09fb39226594bf2f", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "legacy/rust-core/src/fae_llm/observability/redact.rs"}, "region": {"startLine": 210}}}]}, {"ruleId": "scanner-6ee58f9f203e43ca", "level": "note", "message": {"text": "Insecure pattern 'document_write' in native/rust/fae-ui-shell/src/main.rs:1300"}, "properties": {"repobilityId": "eed27cb8bc8cf343", "scanner": "scanner-primary", "fingerprint": "6ee58f9f203e43ca", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["owasp", "document_write"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "native/rust/fae-ui-shell/src/main.rs"}, "region": {"startLine": 1300}}}]}, {"ruleId": "scanner-c2ed218b5bdb07d1", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in native/macos/Fae/Sources/Fae/Resources/Skills/mesh/scripts/serve.py:56"}, "properties": {"repobilityId": "c61feda334977178", "scanner": "scanner-primary", "fingerprint": "c2ed218b5bdb07d1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "native/macos/Fae/Sources/Fae/Resources/Skills/mesh/scripts/serve.py"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-42ae671e2a3a9e89", "level": "error", "message": {"text": "Possible secret in native/macos/Fae/Sources/Fae/Resources/Skills/connect-account/scripts/connect_account.py"}, "properties": {"repobilityId": "58a419a99e1f5500", "scanner": "scanner-primary", "fingerprint": "42ae671e2a3a9e89", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "native/macos/Fae/Sources/Fae/Resources/Skills/connect-account/scripts/connect_account.py"}, "region": {"startLine": 50}}}]}, {"ruleId": "scanner-42ae671e2a3a9e89", "level": "error", "message": {"text": "Possible secret in native/macos/Fae/Sources/Fae/Resources/Skills/connect-account/scripts/connect_account.py"}, "properties": {"repobilityId": "58a419a99e1f5500", "scanner": "scanner-primary", "fingerprint": "42ae671e2a3a9e89", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "native/macos/Fae/Sources/Fae/Resources/Skills/connect-account/scripts/connect_account.py"}, "region": {"startLine": 53}}}]}, {"ruleId": "scanner-42ae671e2a3a9e89", "level": "error", "message": {"text": "Possible secret in native/macos/Fae/Sources/Fae/Resources/Skills/connect-account/scripts/connect_account.py"}, "properties": {"repobilityId": "58a419a99e1f5500", "scanner": "scanner-primary", "fingerprint": "42ae671e2a3a9e89", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "native/macos/Fae/Sources/Fae/Resources/Skills/connect-account/scripts/connect_account.py"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-b0cdc06c1b472f1b", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b91fb7c946f5737d", "scanner": "scanner-primary", "fingerprint": "b0cdc06c1b472f1b", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/linux-render-spike.yml"}, "region": {"startLine": 60}}}]}, {"ruleId": "scanner-b0cdc06c1b472f1b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0a7fe95a8b386a16", "scanner": "scanner-primary", "fingerprint": "b0cdc06c1b472f1b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/linux-render-spike.yml"}, "region": {"startLine": 103}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9e54fac6c290138e", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 127}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a0f3bb36d11e757e", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 130}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5ab0c5bd71e63ad8", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 806}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b0f359fc82dc1097", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 821}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f0dc584a111ffc00", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 877}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e92d31b3cc69227a", "level": "note", "message": {"text": "Very large file: scripts/test-comprehensive.sh (1649 lines)"}, "properties": {"repobilityId": "e2a2e1a4aa5ed0ba", "scanner": "scanner-primary", "fingerprint": "e92d31b3cc69227a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ae5c64e1396bdd80", "level": "note", "message": {"text": "Very large file: legacy/rust-core/src/config.rs (2292 lines)"}, "properties": {"repobilityId": "ea93eaccbbea1d49", "scanner": "scanner-primary", "fingerprint": "ae5c64e1396bdd80", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b836588ac8bc9487", "level": "note", "message": {"text": "Very large file: legacy/rust-core/src/host/channel.rs (2197 lines)"}, "properties": {"repobilityId": "4081803cc22b8285", "scanner": "scanner-primary", "fingerprint": "b836588ac8bc9487", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-52fce887393ab584", "level": "note", "message": {"text": "Very large file: legacy/rust-core/src/host/handler.rs (4344 lines)"}, "properties": {"repobilityId": "dce30586ee9ef212", "scanner": "scanner-primary", "fingerprint": "52fce887393ab584", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a1333c257cf3c5ad", "level": "note", "message": {"text": "Very large file: legacy/rust-core/src/agent/mod.rs (1523 lines)"}, "properties": {"repobilityId": "77fffa6b35356999", "scanner": "scanner-primary", "fingerprint": "a1333c257cf3c5ad", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-91a2dbfb43cdbf9e", "level": "note", "message": {"text": "Very large file: legacy/rust-core/src/fae_llm/agent/loop_engine.rs (1646 lines)"}, "properties": {"repobilityId": "d9d1b49effcb5c79", "scanner": "scanner-primary", "fingerprint": "91a2dbfb43cdbf9e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-692d002ec86114fa", "level": "note", "message": {"text": "Very large file: legacy/rust-core/src/fae_llm/tools/apple/applescript.rs (1379 lines)"}, "properties": {"repobilityId": "131236121bb25dca", "scanner": "scanner-primary", "fingerprint": "692d002ec86114fa", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-1907d83073dc49cb", "level": "note", "message": {"text": "Very large file: legacy/rust-core/src/memory/jsonl.rs (2923 lines)"}, "properties": {"repobilityId": "063933680f30e92b", "scanner": "scanner-primary", "fingerprint": "1907d83073dc49cb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-578c2d38295720e4", "level": "note", "message": {"text": "Very large file: legacy/rust-core/src/memory/sqlite.rs (1779 lines)"}, "properties": {"repobilityId": "38be2fc55fc11c00", "scanner": "scanner-primary", "fingerprint": "578c2d38295720e4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-361b762950ca4c8e", "level": "note", "message": {"text": "Very large file: legacy/rust-core/src/pipeline/coordinator.rs (5192 lines)"}, "properties": {"repobilityId": "a5df20cda436b9b4", "scanner": "scanner-primary", "fingerprint": "361b762950ca4c8e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-89dedcf48c1ac191", "level": "note", "message": {"text": "Very large file: legacy/rust-core/src/skills/python_runner.rs (1837 lines)"}, "properties": {"repobilityId": "acc455aefdf6bb97", "scanner": "scanner-primary", "fingerprint": "89dedcf48c1ac191", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-89d5cbbc5836afdc", "level": "note", "message": {"text": "Very large file: legacy/rust-core/src/scheduler/tasks.rs (1647 lines)"}, "properties": {"repobilityId": "16b9c03c2dfb7f02", "scanner": "scanner-primary", "fingerprint": "89d5cbbc5836afdc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-128256353b318fa6", "level": "note", "message": {"text": "Very large file: native/rust/fae-ui-shell/src/main.rs (1914 lines)"}, "properties": {"repobilityId": "dc63ee8144e57876", "scanner": "scanner-primary", "fingerprint": "128256353b318fa6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "6d54271d40cee2de", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "64806d5b9f90b7ff", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "b63360a0f4d7420c", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "113ccde0baa30ca4", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "5f0b207b155d2fdd", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-640e568063487946", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: native/macos/Fae/Sources/Fae/Resources/Skills/secure-input/SKILL.md"}, "properties": {"repobilityId": "4f27e4b650309a24", "scanner": "scanner-primary", "fingerprint": "640e568063487946", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "native/macos/Fae/Sources/Fae/Resources/Skills/secure-input/SKILL.md"}, "region": {"startLine": 76}}}]}, {"ruleId": "scanner-eff9534cc2c22bfa", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: native/macos/Fae/Sources/Fae/Resources/Skills/focus-defender/SKILL.md"}, "properties": {"repobilityId": "7b459889e26765c6", "scanner": "scanner-primary", "fingerprint": "eff9534cc2c22bfa", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "native/macos/Fae/Sources/Fae/Resources/Skills/focus-defender/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f156e2f2a7a874b7", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: native/macos/Fae/Sources/Fae/Resources/Skills/system-health/SKILL.md"}, "properties": {"repobilityId": "1fdfc458693e72a0", "scanner": "scanner-primary", "fingerprint": "f156e2f2a7a874b7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "native/macos/Fae/Sources/Fae/Resources/Skills/system-health/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9314fb82a0b137b6", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: native/macos/Fae/Sources/Fae/Resources/Skills/capability-discovery/SKILL.md"}, "properties": {"repobilityId": "500671380bbdeaf1", "scanner": "scanner-primary", "fingerprint": "9314fb82a0b137b6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "native/macos/Fae/Sources/Fae/Resources/Skills/capability-discovery/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9a65fd1b63a14af0", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: native/macos/Fae/Sources/Fae/Resources/Skills/file-organizer/SKILL.md"}, "properties": {"repobilityId": "13ad388903775c56", "scanner": "scanner-primary", "fingerprint": "9a65fd1b63a14af0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "native/macos/Fae/Sources/Fae/Resources/Skills/file-organizer/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6da77c13142719b6", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: native/macos/Fae/Sources/Fae/Resources/Skills/document-analyst/SKILL.md"}, "properties": {"repobilityId": "690954741f5b9d5b", "scanner": "scanner-primary", "fingerprint": "6da77c13142719b6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "native/macos/Fae/Sources/Fae/Resources/Skills/document-analyst/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7197ef672fd88a2b", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: native/macos/Fae/Sources/Fae/Resources/Skills/acp-setup/SKILL.md"}, "properties": {"repobilityId": "47c175ea7e078db4", "scanner": "scanner-primary", "fingerprint": "7197ef672fd88a2b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "native/macos/Fae/Sources/Fae/Resources/Skills/acp-setup/SKILL.md"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-ea9ef96729a95bef", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: native/macos/Fae/Sources/Fae/Resources/Skills/connect-account/SKILL.md"}, "properties": {"repobilityId": "33b1d795e8626a1f", "scanner": "scanner-primary", "fingerprint": "ea9ef96729a95bef", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "native/macos/Fae/Sources/Fae/Resources/Skills/connect-account/SKILL.md"}, "region": {"startLine": 53}}}]}, {"ruleId": "scanner-b8bb703b63d00919", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: Skills/apple-ecosystem/SKILL.md"}, "properties": {"repobilityId": "0318fbd9a382a21e", "scanner": "scanner-primary", "fingerprint": "b8bb703b63d00919", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Skills/apple-ecosystem/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d35f177ee2db5c05", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: Skills/packages/native-device-handoff/SKILL.md"}, "properties": {"repobilityId": "da46035fa651f4ea", "scanner": "scanner-primary", "fingerprint": "d35f177ee2db5c05", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Skills/packages/native-device-handoff/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fb979aeefbb695c2", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: Skills/uv-scripts/SKILL.md"}, "properties": {"repobilityId": "f005f96c34fb96fc", "scanner": "scanner-primary", "fingerprint": "fb979aeefbb695c2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Skills/uv-scripts/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e725d2ab884fbd49", "level": "note", "message": {"text": "Multiple root agent instruction files without precedence"}, "properties": {"repobilityId": "1953db6c89508d22", "scanner": "scanner-primary", "fingerprint": "e725d2ab884fbd49", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["agent-instructions", "governance"]}}, {"ruleId": "scanner-32a78087f4ad1212", "level": "none", "message": {"text": "Commented-code block (8 lines) in scripts/hf_jobs_merge_peft_adapter.py:2"}, "properties": {"repobilityId": "7045fadda26d2be0", "scanner": "scanner-primary", "fingerprint": "32a78087f4ad1212", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-03e1f9879469142d", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/convert_speaker_model.py:103"}, "properties": {"repobilityId": "12ec365018352b64", "scanner": "scanner-primary", "fingerprint": "03e1f9879469142d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-88d33de668790e5e", "level": "none", "message": {"text": "Commented-code block (11 lines) in scripts/hf_jobs_train_orpo.py:2"}, "properties": {"repobilityId": "aedf2865cc7f06f1", "scanner": "scanner-primary", "fingerprint": "88d33de668790e5e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1318052b26dc1803", "level": "none", "message": {"text": "Commented-code block (11 lines) in scripts/hf_jobs_train_sft.py:2"}, "properties": {"repobilityId": "2234909d75cb47d9", "scanner": "scanner-primary", "fingerprint": "1318052b26dc1803", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-09c8c0eda62c3f88", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/benchmark_qwen36.py:44"}, "properties": {"repobilityId": "ef5877c03ebadf99", "scanner": "scanner-primary", "fingerprint": "09c8c0eda62c3f88", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6cc5cb28b4068c2c", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/convert-classifier-to-coreml.py:136"}, "properties": {"repobilityId": "ed4eb8e7f2acdfed", "scanner": "scanner-primary", "fingerprint": "6cc5cb28b4068c2c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-66792a09a436261c", "level": "none", "message": {"text": "Commented-code block (6 lines) in native/macos/Fae/Sources/Fae/Resources/Scripts/kokoro_tts_server.py:2"}, "properties": {"repobilityId": "0cdf9eabf88f6a51", "scanner": "scanner-primary", "fingerprint": "66792a09a436261c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f569298568e77b79", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 native/macos/Fae/Sources/Fae/Resources/Skills/training-orchestrator/scripts/train.py:183"}, "properties": {"repobilityId": "54d97ef820426bab", "scanner": "scanner-primary", "fingerprint": "f569298568e77b79", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-f74bbb9632894120", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 native/macos/Fae/Sources/Fae/Resources/Skills/training-orchestrator/scripts/train_dpo.py:157"}, "properties": {"repobilityId": "e6681678ea989972", "scanner": "scanner-primary", "fingerprint": "f74bbb9632894120", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-3a575466e5f23a18", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 native/macos/Fae/Sources/Fae/Resources/Skills/training-orchestrator/scripts/train_stt.py:191"}, "properties": {"repobilityId": "87e5c1ea19f805ec", "scanner": "scanner-primary", "fingerprint": "3a575466e5f23a18", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-7138048fefe19bdd", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 native/macos/Fae/Sources/Fae/Resources/Skills/forge/scripts/init.py:245"}, "properties": {"repobilityId": "e7667380e3eaf1d3", "scanner": "scanner-primary", "fingerprint": "7138048fefe19bdd", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-47495ce5b942cfff", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 native/macos/Fae/Sources/Fae/Resources/Skills/forge/scripts/release.py:424"}, "properties": {"repobilityId": "9d2c93161f24b282", "scanner": "scanner-primary", "fingerprint": "47495ce5b942cfff", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-7fe4c1995362d693", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 native/macos/Fae/Sources/Fae/Resources/Skills/training-data-bridge/scripts/prepare_keyword_data.py:212"}, "properties": {"repobilityId": "a5b6ac7f2d47f868", "scanner": "scanner-primary", "fingerprint": "7fe4c1995362d693", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-30d31d7b076dac9c", "level": "none", "message": {"text": "Commented-code block (5 lines) in native/macos/Fae/Sources/Fae/Resources/Skills/connect-account/scripts/connect_account.py:102"}, "properties": {"repobilityId": "6147b290d48b898d", "scanner": "scanner-primary", "fingerprint": "30d31d7b076dac9c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7b64f1e26731b4bc", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 native/macos/Fae/autoresearch/asr_generate_corpus.py:70"}, "properties": {"repobilityId": "63b4beecf96f64d4", "scanner": "scanner-primary", "fingerprint": "7b64f1e26731b4bc", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-408a176f0382bd3e", "level": "none", "message": {"text": "Commented-code block (5 lines) in native/macos/Fae/autoresearch/interactive.py:176"}, "properties": {"repobilityId": "26cf00aa91b1805d", "scanner": "scanner-primary", "fingerprint": "408a176f0382bd3e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-120d62dc91002969", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 native/macos/Fae/autoresearch/interactive.py:99"}, "properties": {"repobilityId": "2011d09a7b19b157", "scanner": "scanner-primary", "fingerprint": "120d62dc91002969", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "85f08c9c0de469f1", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "34f63df2ef7c8e35", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "2ea15da3fd788516", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "e4851c42c0ad238f", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "046c761bb3d4ce85", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "d357182bf67e9fb8", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "d6742fe70fced964", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "0214073e38c2781b", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "3282822a70874184", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "79c65457f937d97d", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "cdd283d4a68f7ed8", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "b832c6b7e2146055", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "46bd11c9e2d425a8", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "09c57055106f1d12", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "c37ab8502274ea83", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "09101da1b0f5abb2", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "35041b0762511379", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "45d85375ed47caef", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "c049ebd9b940dec9", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "25dde9ddfefd65cd", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-72995c322c5d8284", "level": "error", "message": {"text": "FastAPI POST `api_start_run` without auth dependency \u2014 eval/server.py:124"}, "properties": {"repobilityId": "1ccb60a0e3408dc7", "scanner": "scanner-primary", "fingerprint": "72995c322c5d8284", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "eval/server.py"}, "region": {"startLine": 124}}}]}, {"ruleId": "scanner-4fe822f93cdd90e0", "level": "error", "message": {"text": "FastAPI POST `api_compare` without auth dependency \u2014 eval/server.py:194"}, "properties": {"repobilityId": "0c050ae07a0fd768", "scanner": "scanner-primary", "fingerprint": "4fe822f93cdd90e0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "eval/server.py"}, "region": {"startLine": 194}}}]}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "9242ddb39deb7944", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e9677a42209126dc", "level": "note", "message": {"text": "Unused endpoint: GET /run/{run_id}"}, "properties": {"repobilityId": "bcb30780740526dc", "scanner": "scanner-primary", "fingerprint": "e9677a42209126dc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-18a4887e7bea6b36", "level": "note", "message": {"text": "Unused endpoint: GET /compare"}, "properties": {"repobilityId": "7600428ef2350ed9", "scanner": "scanner-primary", "fingerprint": "18a4887e7bea6b36", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-98248ada9c474560", "level": "note", "message": {"text": "Unused endpoint: GET /api/hardware"}, "properties": {"repobilityId": "f8f1c58cafdb1be5", "scanner": "scanner-primary", "fingerprint": "98248ada9c474560", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f204253066a1fb71", "level": "note", "message": {"text": "Unused endpoint: GET /api/scenarios"}, "properties": {"repobilityId": "3256e8124331389f", "scanner": "scanner-primary", "fingerprint": "f204253066a1fb71", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ca0ee8c086b37844", "level": "note", "message": {"text": "Unused endpoint: GET /api/runs"}, "properties": {"repobilityId": "333d7b35d4ee685b", "scanner": "scanner-primary", "fingerprint": "ca0ee8c086b37844", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b35612e89f90d626", "level": "note", "message": {"text": "Unused endpoint: GET /api/runs/{run_id}"}, "properties": {"repobilityId": "ddac893cd6614b50", "scanner": "scanner-primary", "fingerprint": "b35612e89f90d626", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4088623aa3fbe46f", "level": "note", "message": {"text": "Unused endpoint: GET /api/longitudinal/{model_id}"}, "properties": {"repobilityId": "44187d7288656878", "scanner": "scanner-primary", "fingerprint": "4088623aa3fbe46f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-83f363da8e954ea8", "level": "note", "message": {"text": "Unused endpoint: POST /api/run"}, "properties": {"repobilityId": "b573e14ecb3fd458", "scanner": "scanner-primary", "fingerprint": "83f363da8e954ea8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d82cc471afad2ab8", "level": "note", "message": {"text": "Unused endpoint: GET /api/stream/{run_id}"}, "properties": {"repobilityId": "c006106854b523ba", "scanner": "scanner-primary", "fingerprint": "d82cc471afad2ab8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c4221670861e52f0", "level": "note", "message": {"text": "Unused endpoint: POST /api/compare"}, "properties": {"repobilityId": "88e8c24a31a272d4", "scanner": "scanner-primary", "fingerprint": "c4221670861e52f0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}