{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-0d03e104c80f0608", "name": "Privileged port 13 in use", "shortDescription": {"text": "Privileged port 13 in use"}, "fullDescription": {"text": "Port 13 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-40216e4b115a3923", "name": "Dockerfile runs as root: research/w7-orchestrator-convergence/dind-spike/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: research/w7-orchestrator-convergence/dind-spike/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c047acff60bcbf3e", "name": "Docker base image is tag-pinned but not digest-pinned: ubuntu:24.04", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: ubuntu:24.04"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a6d190090cee869c", "name": "Dockerfile runs as root: orchestrator-image/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: orchestrator-image/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3a0b1dcf6b81bb2d", "name": "Docker base image is tag-pinned but not digest-pinned: ubuntu:24.04", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: ubuntu:24.04"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bfdd551f4ab5145b", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "thewoolleyman/livespec-dev-tooling/.github/workflows/reusable-release-dispatch.yml@v0.14.0 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f7c7d25911e6e1e4", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/create-github-app-token@v1 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-31fbbdc8ce83e8ee", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bc3ce29759f48e19", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1d6b44d9c97d92f3", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "thewoolleyman/livespec-dev-tooling/.github/workflows/reusable-bump-pin-from-dispatch.yml@v0.14.0 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-27924aa79fa4a517", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-439f67880be4c9ed", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/create-github-app-token@v1 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-61070c77739661be", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "thewoolleyman/livespec-dev-tooling/.github/workflows/reusable-pin-freshness.yml@v0.14.0 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8bf189db4a7c4115", "name": "Very large file: tests/livespec_impl_beads/commands/test_dispatcher.py (2625 lines)", "shortDescription": {"text": "Very large file: tests/livespec_impl_beads/commands/test_dispatcher.py (2625 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-44f3471c2ecb189e", "name": "Agent authority lacks a verifier contract: dev-tooling/CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: dev-tooling/CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-122f91b7f2906dc4", "name": "Agent authority lacks a verifier contract: .claude/settings.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-632f6ef94b8d3d69", "name": "Commented-code block (6 lines) in dev-tooling/checks/work_item_merge_evidence.py:54", "shortDescription": {"text": "Commented-code block (6 lines) in dev-tooling/checks/work_item_merge_evidence.py:54"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-dd02f1d2702ae50e", "name": "Network/subprocess call without timeout or try/except \u2014 dev-tooling/checks/work_item_merge_evidence.py:110", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 dev-tooling/checks/work_item_merge_evidence.py:110"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-70bd3ae957598db8", "name": "Commented-code block (8 lines) in tests/livespec_impl_beads/conftest.py:32", "shortDescription": {"text": "Commented-code block (8 lines) in tests/livespec_impl_beads/conftest.py:32"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b2982d56d86118b4", "name": "Commented-code block (5 lines) in tests/livespec_impl_beads/commands/test_dispatcher_heartbeat_probe.py:334", "shortDescription": {"text": "Commented-code block (5 lines) in tests/livespec_impl_beads/commands/test_dispatcher_heartbeat_probe.py:334"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-618064733c53cdf8", "name": "Commented-code block (5 lines) in tests/livespec_impl_beads/commands/test_list_work_items.py:31", "shortDescription": {"text": "Commented-code block (5 lines) in tests/livespec_impl_beads/commands/test_list_work_items.py:31"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e6c4790c60b880f4", "name": "Legacy-named symbol `nLegacy` in tests/livespec_impl_beads/commands/test_detect_impl_gaps.py:318", "shortDescription": {"text": "Legacy-named symbol `nLegacy` in tests/livespec_impl_beads/commands/test_detect_impl_gaps.py:318"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8cd9d1ca8367bec2", "name": "Commented-code block (7 lines) in tests/livespec_impl_beads/commands/test_dispatcher.py:109", "shortDescription": {"text": "Commented-code block (7 lines) in tests/livespec_impl_beads/commands/test_dispatcher.py:109"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b261a8346dd76a48", "name": "Commented-code block (5 lines) in tests/e2e-cli/test_cli_e2e_round_trip.py:35", "shortDescription": {"text": "Commented-code block (5 lines) in tests/e2e-cli/test_cli_e2e_round_trip.py:35"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/21171"}, "properties": {"repository": "thewoolleyman/livespec-impl-beads", "repoUrl": "https://github.com/thewoolleyman/livespec-impl-beads", "branch": "main"}, "results": [{"ruleId": "scanner-0d03e104c80f0608", "level": "warning", "message": {"text": "Privileged port 13 in use"}, "properties": {"repobilityId": "79d721e4d6f64798", "scanner": "scanner-primary", "fingerprint": "0d03e104c80f0608", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pin-freshness.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-40216e4b115a3923", "level": "warning", "message": {"text": "Dockerfile runs as root: research/w7-orchestrator-convergence/dind-spike/Dockerfile"}, "properties": {"repobilityId": "348183fd79eb81b3", "scanner": "scanner-primary", "fingerprint": "40216e4b115a3923", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-c047acff60bcbf3e", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: ubuntu:24.04"}, "properties": {"repobilityId": "6fbd39e0578d022b", "scanner": "scanner-primary", "fingerprint": "c047acff60bcbf3e", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "research/w7-orchestrator-convergence/dind-spike/Dockerfile"}, "region": {"startLine": 13}}}]}, {"ruleId": "scanner-a6d190090cee869c", "level": "warning", "message": {"text": "Dockerfile runs as root: orchestrator-image/Dockerfile"}, "properties": {"repobilityId": "2833db9b4a61feac", "scanner": "scanner-primary", "fingerprint": "a6d190090cee869c", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-3a0b1dcf6b81bb2d", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: ubuntu:24.04"}, "properties": {"repobilityId": "53d86f4477b5c82f", "scanner": "scanner-primary", "fingerprint": "3a0b1dcf6b81bb2d", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "orchestrator-image/Dockerfile"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-bfdd551f4ab5145b", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b1db60b4cb34680a", "scanner": "scanner-primary", "fingerprint": "bfdd551f4ab5145b", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release-dispatch.yml"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-f7c7d25911e6e1e4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "851b58f92a898a8e", "scanner": "scanner-primary", "fingerprint": "f7c7d25911e6e1e4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/auto-update-branches.yml"}, "region": {"startLine": 50}}}]}, {"ruleId": "scanner-31fbbdc8ce83e8ee", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "6311de3c5fe9d5eb", "scanner": "scanner-primary", "fingerprint": "31fbbdc8ce83e8ee", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/auto-update-branches.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bc3ce29759f48e19", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1bb06b2dbbd4396b", "scanner": "scanner-primary", "fingerprint": "bc3ce29759f48e19", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/copier-update-drift.yml"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-bc3ce29759f48e19", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "fca84877a7c09794", "scanner": "scanner-primary", "fingerprint": "bc3ce29759f48e19", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/copier-update-drift.yml"}, "region": {"startLine": 45}}}]}, {"ruleId": "scanner-1d6b44d9c97d92f3", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4a011cab08acbc62", "scanner": "scanner-primary", "fingerprint": "1d6b44d9c97d92f3", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/bump-pin-from-dispatch.yml"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ae16880318b99912", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 41}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ae16880318b99912", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 98}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9ad4c3f023525f19", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 102}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ae16880318b99912", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 147}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9ad4c3f023525f19", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 176}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ae16880318b99912", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 212}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9ad4c3f023525f19", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 216}}}]}, {"ruleId": "scanner-439f67880be4c9ed", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "dcb55af0330e9946", "scanner": "scanner-primary", "fingerprint": "439f67880be4c9ed", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/auto-enable-merge.yml"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-61070c77739661be", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ab6d6bea3e7decfe", "scanner": "scanner-primary", "fingerprint": "61070c77739661be", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pin-freshness.yml"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-8bf189db4a7c4115", "level": "note", "message": {"text": "Very large file: tests/livespec_impl_beads/commands/test_dispatcher.py (2625 lines)"}, "properties": {"repobilityId": "231ee1020bc3a207", "scanner": "scanner-primary", "fingerprint": "8bf189db4a7c4115", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "6d3a0e8c623db9d4", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "e25364e5868958af", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "e521e4408f28b71a", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "0d6c226763436e93", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-44f3471c2ecb189e", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: dev-tooling/CLAUDE.md"}, "properties": {"repobilityId": "49f0105254624ee5", "scanner": "scanner-primary", "fingerprint": "44f3471c2ecb189e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dev-tooling/CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-122f91b7f2906dc4", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "properties": {"repobilityId": "a2967269048b6a9d", "scanner": "scanner-primary", "fingerprint": "122f91b7f2906dc4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/settings.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-632f6ef94b8d3d69", "level": "none", "message": {"text": "Commented-code block (6 lines) in dev-tooling/checks/work_item_merge_evidence.py:54"}, "properties": {"repobilityId": "84006a24d00c7d8e", "scanner": "scanner-primary", "fingerprint": "632f6ef94b8d3d69", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-dd02f1d2702ae50e", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 dev-tooling/checks/work_item_merge_evidence.py:110"}, "properties": {"repobilityId": "99d298ecb0f84337", "scanner": "scanner-primary", "fingerprint": "dd02f1d2702ae50e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-70bd3ae957598db8", "level": "none", "message": {"text": "Commented-code block (8 lines) in tests/livespec_impl_beads/conftest.py:32"}, "properties": {"repobilityId": "509b47dca08c0164", "scanner": "scanner-primary", "fingerprint": "70bd3ae957598db8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b2982d56d86118b4", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/livespec_impl_beads/commands/test_dispatcher_heartbeat_probe.py:334"}, "properties": {"repobilityId": "b2036a2b885620a9", "scanner": "scanner-primary", "fingerprint": "b2982d56d86118b4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-618064733c53cdf8", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/livespec_impl_beads/commands/test_list_work_items.py:31"}, "properties": {"repobilityId": "cde85bba9f6446dd", "scanner": "scanner-primary", "fingerprint": "618064733c53cdf8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e6c4790c60b880f4", "level": "note", "message": {"text": "Legacy-named symbol `nLegacy` in tests/livespec_impl_beads/commands/test_detect_impl_gaps.py:318"}, "properties": {"repobilityId": "0e82b74b3e96c515", "scanner": "scanner-primary", "fingerprint": "e6c4790c60b880f4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-8cd9d1ca8367bec2", "level": "none", "message": {"text": "Commented-code block (7 lines) in tests/livespec_impl_beads/commands/test_dispatcher.py:109"}, "properties": {"repobilityId": "ca19237d6970fb31", "scanner": "scanner-primary", "fingerprint": "8cd9d1ca8367bec2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b261a8346dd76a48", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/e2e-cli/test_cli_e2e_round_trip.py:35"}, "properties": {"repobilityId": "c81e3be15c0d3c5e", "scanner": "scanner-primary", "fingerprint": "b261a8346dd76a48", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}]}]}