{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-c942e9b3a12923b7", "name": "Possibly dead Python function: weight", "shortDescription": {"text": "Possibly dead Python function: weight"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-56484435a988c2b0", "name": "Possibly dead Python function: to_dict", "shortDescription": {"text": "Possibly dead Python function: to_dict"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-747fe50c45634d9f", "name": "Possibly dead Python function: make_merge_context", "shortDescription": {"text": "Possibly dead Python function: make_merge_context"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3bd087fa6f14a615", "name": "Possibly dead Python function: worker", "shortDescription": {"text": "Possibly dead Python function: worker"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e604eb04e60ec82a", "name": "Possibly dead Python function: getter", "shortDescription": {"text": "Possibly dead Python function: getter"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f3bc8f5464ecb184", "name": "Possibly dead Python function: worker", "shortDescription": {"text": "Possibly dead Python function: worker"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-070fdec3b937d307", "name": "Possibly dead Python function: stale", "shortDescription": {"text": "Possibly dead Python function: stale"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f43541085d4f9766", "name": "Possibly dead Python function: do_GET", "shortDescription": {"text": "Possibly dead Python function: do_GET"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5bdf683ee98c9b4e", "name": "Possibly dead Python function: log_message", "shortDescription": {"text": "Possibly dead Python function: log_message"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a8216de66b85dda4", "name": "Possibly dead Python function: gh_available", "shortDescription": {"text": "Possibly dead Python function: gh_available"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a87dbd99c67309dd", "name": "Possibly dead Python function: detect_cheapest_model", "shortDescription": {"text": "Possibly dead Python function: detect_cheapest_model"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bf3a6a276eb21636", "name": "Insecure pattern 'direct_innerhtml_assignment' in agit/metrics/web.py:647", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in agit/metrics/web.py:647"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9a6e33cff2ac44e7", "name": "Very large file: tests/test_proxy.py (4627 lines)", "shortDescription": {"text": "Very large file: tests/test_proxy.py (4627 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0189f3318a647db1", "name": "Very large file: agit/proxy/runner.py (4831 lines)", "shortDescription": {"text": "Very large file: agit/proxy/runner.py (4831 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 94 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2679282aa1c484b5", "name": "Agent authority lacks a verifier contract: AGENTS.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: AGENTS.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-46b2ba82973d3324", "name": "Commented-code block (6 lines) in tests/test_backend_process.py:119", "shortDescription": {"text": "Commented-code block (6 lines) in tests/test_backend_process.py:119"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f178941f93fc38bd", "name": "Commented-code block (5 lines) in tests/test_worktree.py:988", "shortDescription": {"text": "Commented-code block (5 lines) in tests/test_worktree.py:988"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-05c3bd9afe543e35", "name": "Commented-code block (5 lines) in tests/test_claude_session.py:428", "shortDescription": {"text": "Commented-code block (5 lines) in tests/test_claude_session.py:428"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2e8b27f58a426ae0", "name": "Commented-code block (5 lines) in tests/test_pre_compaction.py:96", "shortDescription": {"text": "Commented-code block (5 lines) in tests/test_pre_compaction.py:96"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3c6323c017fcb37c", "name": "Legacy-named symbol `test_corrupt_state_json_falls_back_to_defaults_and_keeps_backup` in tests/test_state.py:128", "shortDescription": {"text": "Legacy-named symbol `test_corrupt_state_json_falls_back_to_defaults_and_keeps_backup` in tests/test_state.py:128"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-01ef1697a99b93d5", "name": "Commented-code block (6 lines) in tests/test_proxy.py:851", "shortDescription": {"text": "Commented-code block (6 lines) in tests/test_proxy.py:851"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2d3a282aa74531aa", "name": "Network/subprocess call without timeout or try/except \u2014 agit/cli.py:126", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 agit/cli.py:126"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9b80802caa308317", "name": "Network/subprocess call without timeout or try/except \u2014 agit/backends/opencode.py:37", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 agit/backends/opencode.py:37"}, "fullDescription": {"text": "`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-02f98a2b100a18b6", "name": "Commented-code block (5 lines) in agit/backends/claude.py:84", "shortDescription": {"text": "Commented-code block (5 lines) in agit/backends/claude.py:84"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b3e82f4cd17099fb", "name": "Network/subprocess call without timeout or try/except \u2014 agit/backends/claude.py:26", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 agit/backends/claude.py:26"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2ff3932e9f1fb12f", "name": "Commented-code block (6 lines) in agit/proxy/terminal.py:104", "shortDescription": {"text": "Commented-code block (6 lines) in agit/proxy/terminal.py:104"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-235c901b215afb7d", "name": "Commented-code block (5 lines) in agit/proxy/renderer.py:24", "shortDescription": {"text": "Commented-code block (5 lines) in agit/proxy/renderer.py:24"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7061ea5342450985", "name": "Commented-code block (8 lines) in agit/proxy/runner.py:72", "shortDescription": {"text": "Commented-code block (8 lines) in agit/proxy/runner.py:72"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0d573c098a11c334", "name": "Commented-code block (5 lines) in agit/proxy/commit_engine.py:207", "shortDescription": {"text": "Commented-code block (5 lines) in agit/proxy/commit_engine.py:207"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fe878d8e0a061741", "name": "Network/subprocess call without timeout or try/except \u2014 agit/git/repo.py:18", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 agit/git/repo.py:18"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-af70604715717dd0", "name": "Commented-code block (7 lines) in agit/commits/message.py:381", "shortDescription": {"text": "Commented-code block (7 lines) in agit/commits/message.py:381"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0e3595cd28c6c17e", "name": "Commented-code block (5 lines) in agit/transcripts/types.py:16", "shortDescription": {"text": "Commented-code block (5 lines) in agit/transcripts/types.py:16"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ffb2d4d69d0cd2da", "name": "Commented-code block (5 lines) in agit/transcripts/opencode.py:244", "shortDescription": {"text": "Commented-code block (5 lines) in agit/transcripts/opencode.py:244"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e6beed834df16758", "name": "Network/subprocess call without timeout or try/except \u2014 agit/transcripts/opencode.py:30", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 agit/transcripts/opencode.py:30"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-11a6dedb3c019b6f", "name": "Commented-code block (9 lines) in agit/transcripts/claude.py:65", "shortDescription": {"text": "Commented-code block (9 lines) in agit/transcripts/claude.py:65"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c17484adea71d639", "name": "Commented-code block (5 lines) in agit/metrics/collect.py:457", "shortDescription": {"text": "Commented-code block (5 lines) in agit/metrics/collect.py:457"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6ef8465a7e96079b", "name": "Commented-code block (5 lines) in agit/summaries/summarizer.py:23", "shortDescription": {"text": "Commented-code block (5 lines) in agit/summaries/summarizer.py:23"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nagit/backends/proxy_agents.py:new_session_id, agit/backends/proxy_agents.py:new_session_id, agit/backends/proxy_agents.py:new_session_id\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nagit/proxy/session.py:child_pid, agit/proxy/session.py:child_pid\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/25088"}, "properties": {"repository": "core-aix/agit", "repoUrl": "https://github.com/core-aix/agit", "branch": "main"}, "results": [{"ruleId": "scanner-c942e9b3a12923b7", "level": "note", "message": {"text": "Possibly dead Python function: weight"}, "properties": {"repobilityId": "85d58bfe63a2040f", "scanner": "scanner-primary", "fingerprint": "c942e9b3a12923b7", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agit/backends/claude.py:93"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-56484435a988c2b0", "level": "note", "message": {"text": "Possibly dead Python function: to_dict"}, "properties": {"repobilityId": "017f31ed997ca27d", "scanner": "scanner-primary", "fingerprint": "56484435a988c2b0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agit/backends/base.py:39"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-747fe50c45634d9f", "level": "note", "message": {"text": "Possibly dead Python function: make_merge_context"}, "properties": {"repobilityId": "2fbff84187c06f75", "scanner": "scanner-primary", "fingerprint": "747fe50c45634d9f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agit/proxy/integration.py:321"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3bd087fa6f14a615", "level": "note", "message": {"text": "Possibly dead Python function: worker"}, "properties": {"repobilityId": "fbe2b50200068803", "scanner": "scanner-primary", "fingerprint": "3bd087fa6f14a615", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agit/proxy/runner.py:4324"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e604eb04e60ec82a", "level": "note", "message": {"text": "Possibly dead Python function: getter"}, "properties": {"repobilityId": "dd2108739777538a", "scanner": "scanner-primary", "fingerprint": "e604eb04e60ec82a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agit/proxy/runner.py:4816"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f3bc8f5464ecb184", "level": "note", "message": {"text": "Possibly dead Python function: worker"}, "properties": {"repobilityId": "fbe2b50200068803", "scanner": "scanner-primary", "fingerprint": "f3bc8f5464ecb184", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agit/proxy/commit_engine.py:532"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-070fdec3b937d307", "level": "note", "message": {"text": "Possibly dead Python function: stale"}, "properties": {"repobilityId": "ce37f4e5c3786e31", "scanner": "scanner-primary", "fingerprint": "070fdec3b937d307", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agit/git/worktree.py:98"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f43541085d4f9766", "level": "note", "message": {"text": "Possibly dead Python function: do_GET"}, "properties": {"repobilityId": "2d943bb45e4f13bd", "scanner": "scanner-primary", "fingerprint": "f43541085d4f9766", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agit/metrics/server.py:41"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5bdf683ee98c9b4e", "level": "note", "message": {"text": "Possibly dead Python function: log_message"}, "properties": {"repobilityId": "965f3150b4af5b2e", "scanner": "scanner-primary", "fingerprint": "5bdf683ee98c9b4e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agit/metrics/server.py:92"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a8216de66b85dda4", "level": "note", "message": {"text": "Possibly dead Python function: gh_available"}, "properties": {"repobilityId": "c907bc770498dcb0", "scanner": "scanner-primary", "fingerprint": "a8216de66b85dda4", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agit/metrics/github.py:32"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a87dbd99c67309dd", "level": "note", "message": {"text": "Possibly dead Python function: detect_cheapest_model"}, "properties": {"repobilityId": "250c8e7431536695", "scanner": "scanner-primary", "fingerprint": "a87dbd99c67309dd", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agit/summaries/model_select.py:12"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bf3a6a276eb21636", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in agit/metrics/web.py:647"}, "properties": {"repobilityId": "40661de4ff57fe4d", "scanner": "scanner-primary", "fingerprint": "bf3a6a276eb21636", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agit/metrics/web.py"}, "region": {"startLine": 647}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-9a6e33cff2ac44e7", "level": "note", "message": {"text": "Very large file: tests/test_proxy.py (4627 lines)"}, "properties": {"repobilityId": "6f201df6f8faa381", "scanner": "scanner-primary", "fingerprint": "9a6e33cff2ac44e7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-0189f3318a647db1", "level": "note", "message": {"text": "Very large file: agit/proxy/runner.py (4831 lines)"}, "properties": {"repobilityId": "10df675994b3c248", "scanner": "scanner-primary", "fingerprint": "0189f3318a647db1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "ebbdcfde6d9a190d", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "3a5064557c0b7740", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-2679282aa1c484b5", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: AGENTS.md"}, "properties": {"repobilityId": "27d579812e6be614", "scanner": "scanner-primary", "fingerprint": "2679282aa1c484b5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agents_md"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "AGENTS.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-46b2ba82973d3324", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/test_backend_process.py:119"}, "properties": {"repobilityId": "7e2fcc496f3d3924", "scanner": "scanner-primary", "fingerprint": "46b2ba82973d3324", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f178941f93fc38bd", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/test_worktree.py:988"}, "properties": {"repobilityId": "3d80923ab8067e06", "scanner": "scanner-primary", "fingerprint": "f178941f93fc38bd", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-05c3bd9afe543e35", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/test_claude_session.py:428"}, "properties": {"repobilityId": "32478863631b9fd3", "scanner": "scanner-primary", "fingerprint": "05c3bd9afe543e35", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2e8b27f58a426ae0", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/test_pre_compaction.py:96"}, "properties": {"repobilityId": "dfd8289bca96c26c", "scanner": "scanner-primary", "fingerprint": "2e8b27f58a426ae0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3c6323c017fcb37c", "level": "note", "message": {"text": "Legacy-named symbol `test_corrupt_state_json_falls_back_to_defaults_and_keeps_backup` in tests/test_state.py:128"}, "properties": {"repobilityId": "e1acf97f9f1977b0", "scanner": "scanner-primary", "fingerprint": "3c6323c017fcb37c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-01ef1697a99b93d5", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/test_proxy.py:851"}, "properties": {"repobilityId": "e8288f4da7942528", "scanner": "scanner-primary", "fingerprint": "01ef1697a99b93d5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2d3a282aa74531aa", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 agit/cli.py:126"}, "properties": {"repobilityId": "c96339dab735e761", "scanner": "scanner-primary", "fingerprint": "2d3a282aa74531aa", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-9b80802caa308317", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 agit/backends/opencode.py:37"}, "properties": {"repobilityId": "0262804393a59a52", "scanner": "scanner-primary", "fingerprint": "9b80802caa308317", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-02f98a2b100a18b6", "level": "none", "message": {"text": "Commented-code block (5 lines) in agit/backends/claude.py:84"}, "properties": {"repobilityId": "ccffd4127a21cbce", "scanner": "scanner-primary", "fingerprint": "02f98a2b100a18b6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b3e82f4cd17099fb", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 agit/backends/claude.py:26"}, "properties": {"repobilityId": "75e4280949794aee", "scanner": "scanner-primary", "fingerprint": "b3e82f4cd17099fb", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2ff3932e9f1fb12f", "level": "none", "message": {"text": "Commented-code block (6 lines) in agit/proxy/terminal.py:104"}, "properties": {"repobilityId": "1901552d8b56f89c", "scanner": "scanner-primary", "fingerprint": "2ff3932e9f1fb12f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-235c901b215afb7d", "level": "none", "message": {"text": "Commented-code block (5 lines) in agit/proxy/renderer.py:24"}, "properties": {"repobilityId": "0b110ea156ae355a", "scanner": "scanner-primary", "fingerprint": "235c901b215afb7d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7061ea5342450985", "level": "none", "message": {"text": "Commented-code block (8 lines) in agit/proxy/runner.py:72"}, "properties": {"repobilityId": "c1accafab16c7122", "scanner": "scanner-primary", "fingerprint": "7061ea5342450985", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0d573c098a11c334", "level": "none", "message": {"text": "Commented-code block (5 lines) in agit/proxy/commit_engine.py:207"}, "properties": {"repobilityId": "f18029c049eb2e7c", "scanner": "scanner-primary", "fingerprint": "0d573c098a11c334", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fe878d8e0a061741", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 agit/git/repo.py:18"}, "properties": {"repobilityId": "47f9d2739c3b41fe", "scanner": "scanner-primary", "fingerprint": "fe878d8e0a061741", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-af70604715717dd0", "level": "none", "message": {"text": "Commented-code block (7 lines) in agit/commits/message.py:381"}, "properties": {"repobilityId": "612fe0c8d6412709", "scanner": "scanner-primary", "fingerprint": "af70604715717dd0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0e3595cd28c6c17e", "level": "none", "message": {"text": "Commented-code block (5 lines) in agit/transcripts/types.py:16"}, "properties": {"repobilityId": "ee8d58516fe42868", "scanner": "scanner-primary", "fingerprint": "0e3595cd28c6c17e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ffb2d4d69d0cd2da", "level": "none", "message": {"text": "Commented-code block (5 lines) in agit/transcripts/opencode.py:244"}, "properties": {"repobilityId": "c3250642b7231d15", "scanner": "scanner-primary", "fingerprint": "ffb2d4d69d0cd2da", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e6beed834df16758", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 agit/transcripts/opencode.py:30"}, "properties": {"repobilityId": "d64108d7af029005", "scanner": "scanner-primary", "fingerprint": "e6beed834df16758", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-11a6dedb3c019b6f", "level": "none", "message": {"text": "Commented-code block (9 lines) in agit/transcripts/claude.py:65"}, "properties": {"repobilityId": "a4a50da4acb88c52", "scanner": "scanner-primary", "fingerprint": "11a6dedb3c019b6f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c17484adea71d639", "level": "none", "message": {"text": "Commented-code block (5 lines) in agit/metrics/collect.py:457"}, "properties": {"repobilityId": "37a1791be4901355", "scanner": "scanner-primary", "fingerprint": "c17484adea71d639", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6ef8465a7e96079b", "level": "none", "message": {"text": "Commented-code block (5 lines) in agit/summaries/summarizer.py:23"}, "properties": {"repobilityId": "351272f72702d996", "scanner": "scanner-primary", "fingerprint": "6ef8465a7e96079b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "90daa5be81e2251c", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "41190ae2c8599e5d", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "5cdd5444f15e46e1", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "6114e182aedd4f23", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "c12fecf8009c4440", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "6bef42e2744fe3c5", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "3482dcecf4eb13e8", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "cd3b5122b3d5acbf", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "54b7661c41f77385", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "34bc3e373dc5b7ec", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "c070a78d60355947", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "44717f8a5e7c2911", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "456e0042323d67ef", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "1864937db3ca5c95", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "9d4a4fb55b32ffc2", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "b54525365cabdaae", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "8cc87014c6dfd2f3", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "044544ddd4543753", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "c9397538f7a1fc81", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "b2e05655fe7c4ae0", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}]}]}