{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-df5b93a53306a33c", "name": "Possibly dead Python function: compose", "shortDescription": {"text": "Possibly dead Python function: compose"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-50a829ee01ceed13", "name": "Possibly dead Python function: action_recompute_baselines", "shortDescription": {"text": "Possibly dead Python function: action_recompute_baselines"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2a6ca8c473701362", "name": "Possibly dead Python function: validate_slug", "shortDescription": {"text": "Possibly dead Python function: validate_slug"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d2d1ecc1fc35d857", "name": "Possibly dead Python function: bump_cursor", "shortDescription": {"text": "Possibly dead Python function: bump_cursor"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c15cf720a3497bb6", "name": "Privileged port 13 in use", "shortDescription": {"text": "Privileged port 13 in use"}, "fullDescription": {"text": "Port 13 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f5ba2dd9df873cb2", "name": "Privileged port 18 in use", "shortDescription": {"text": "Privileged port 18 in use"}, "fullDescription": {"text": "Port 18 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9817e7cebd62ee78", "name": "Privileged port 23 in use", "shortDescription": {"text": "Privileged port 23 in use"}, "fullDescription": {"text": "Port 23 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b4c1614a4ec5226b", "name": "Privileged port 24 in use", "shortDescription": {"text": "Privileged port 24 in use"}, "fullDescription": {"text": "Port 24 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ba6bf0545f87e1be", "name": "Privileged port 30 in use", "shortDescription": {"text": "Privileged port 30 in use"}, "fullDescription": {"text": "Port 30 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3c3b92cda3101982", "name": "Privileged port 17 in use", "shortDescription": {"text": "Privileged port 17 in use"}, "fullDescription": {"text": "Port 17 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fda9adad13202848", "name": "Privileged port 40 in use", "shortDescription": {"text": "Privileged port 40 in use"}, "fullDescription": {"text": "Port 40 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4ceeefc85746ec6a", "name": "Privileged port 26 in use", "shortDescription": {"text": "Privileged port 26 in use"}, "fullDescription": {"text": "Port 26 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fd815f45da0966e2", "name": "Privileged port 20 in use", "shortDescription": {"text": "Privileged port 20 in use"}, "fullDescription": {"text": "Port 20 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d0201598c49bb78c", "name": "Privileged port 32 in use", "shortDescription": {"text": "Privileged port 32 in use"}, "fullDescription": {"text": "Port 32 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-af4cc98cf621b5ee", "name": "Privileged port 33 in use", "shortDescription": {"text": "Privileged port 33 in use"}, "fullDescription": {"text": "Port 33 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4b9ada079e04859f", "name": "Privileged port 34 in use", "shortDescription": {"text": "Privileged port 34 in use"}, "fullDescription": {"text": "Port 34 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c5c619f2e06fcfa6", "name": "Privileged port 15 in use", "shortDescription": {"text": "Privileged port 15 in use"}, "fullDescription": {"text": "Port 15 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea79d58990f24cfb", "name": "Privileged port 16 in use", "shortDescription": {"text": "Privileged port 16 in use"}, "fullDescription": {"text": "Port 16 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ae197f5b5fdb2450", "name": "Insecure pattern 'subprocess_shell_true' in factory/runner.py:648", "shortDescription": {"text": "Insecure pattern 'subprocess_shell_true' in factory/runner.py:648"}, "fullDescription": {"text": "Found a known-risky pattern (subprocess_shell_true). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-796aaf70ec062a5a", "name": "Insecure pattern 'subprocess_shell_true' in factory/manager/circuit_breaker.py:247", "shortDescription": {"text": "Insecure pattern 'subprocess_shell_true' in factory/manager/circuit_breaker.py:247"}, "fullDescription": {"text": "Found a known-risky pattern (subprocess_shell_true). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-138f12eebca27317", "name": "Insecure pattern 'subprocess_shell_true' in factory/deploy/runner.py:125", "shortDescription": {"text": "Insecure pattern 'subprocess_shell_true' in factory/deploy/runner.py:125"}, "fullDescription": {"text": "Found a known-risky pattern (subprocess_shell_true). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b7209f1233e2e1fb", "name": "Insecure pattern 'subprocess_shell_true' in factory/chain/scheduled_tasks.py:156", "shortDescription": {"text": "Insecure pattern 'subprocess_shell_true' in factory/chain/scheduled_tasks.py:156"}, "fullDescription": {"text": "Found a known-risky pattern (subprocess_shell_true). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ab5f9929f5893cf4", "name": "Insecure pattern 'subprocess_shell_true' in factory/chain/gates/evaluator.py:105", "shortDescription": {"text": "Insecure pattern 'subprocess_shell_true' in factory/chain/gates/evaluator.py:105"}, "fullDescription": {"text": "Found a known-risky pattern (subprocess_shell_true). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7efbda965f283c17", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5876393a95bc2175", "name": "Very large file: factory/cli.py (2900 lines)", "shortDescription": {"text": "Very large file: factory/cli.py (2900 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-33506fe31c2974e9", "name": "Very large file: factory/runner.py (1600 lines)", "shortDescription": {"text": "Very large file: factory/runner.py (1600 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1d40c25cd1c8dee9", "name": "Very large file: factory/chain/handlers.py (2822 lines)", "shortDescription": {"text": "Very large file: factory/chain/handlers.py (2822 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 96 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 60 placeholder/mock markers across 16 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f7ba31c0a6ea685c", "name": "Commented-code block (6 lines) in tests/test_app_gates_config.py:21", "shortDescription": {"text": "Commented-code block (6 lines) in tests/test_app_gates_config.py:21"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4b1bfb0ae5b82be9", "name": "Commented-code block (5 lines) in tests/test_handler_tech_writer.py:21", "shortDescription": {"text": "Commented-code block (5 lines) in tests/test_handler_tech_writer.py:21"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ae59ad457bdb72b3", "name": "Legacy-named symbol `t_very_old` in tests/manager/test_watcher.py:320", "shortDescription": {"text": "Legacy-named symbol `t_very_old` in tests/manager/test_watcher.py:320"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-050c64d8b41d4acd", "name": "Legacy-named symbol `too_old` in tests/manager/detectors/test_placeholder_prompts.py:54", "shortDescription": {"text": "Legacy-named symbol `too_old` in tests/manager/detectors/test_placeholder_prompts.py:54"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c1805e6117d6aeab", "name": "Commented-code block (5 lines) in factory/cli.py:507", "shortDescription": {"text": "Commented-code block (5 lines) in factory/cli.py:507"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-39a6df857d4b8e4c", "name": "Commented-code block (7 lines) in factory/app_config.py:65", "shortDescription": {"text": "Commented-code block (7 lines) in factory/app_config.py:65"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-dbbc6eaa1a697539", "name": "Commented-code block (10 lines) in factory/runner.py:38", "shortDescription": {"text": "Commented-code block (10 lines) in factory/runner.py:38"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b69800cbb6a45b84", "name": "Commented-code block (6 lines) in factory/settings/spend.py:58", "shortDescription": {"text": "Commented-code block (6 lines) in factory/settings/spend.py:58"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7eab3a021dee1227", "name": "Commented-code block (7 lines) in factory/manager/diagnostician.py:323", "shortDescription": {"text": "Commented-code block (7 lines) in factory/manager/diagnostician.py:323"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cfafaf5e94d138d9", "name": "Commented-code block (10 lines) in factory/manager/apply.py:101", "shortDescription": {"text": "Commented-code block (10 lines) in factory/manager/apply.py:101"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bd2cc8fa6b0b48e2", "name": "Network/subprocess call without timeout or try/except \u2014 factory/manager/circuit_breaker.py:324", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 factory/manager/circuit_breaker.py:324"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dfb656ee98fcfc8c", "name": "Commented-code block (7 lines) in factory/manager/halt.py:30", "shortDescription": {"text": "Commented-code block (7 lines) in factory/manager/halt.py:30"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-866ddcc64604d863", "name": "Commented-code block (5 lines) in factory/manager/signals.py:48", "shortDescription": {"text": "Commented-code block (5 lines) in factory/manager/signals.py:48"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ace8023ff5fceaf8", "name": "Commented-code block (5 lines) in factory/manager/watcher.py:507", "shortDescription": {"text": "Commented-code block (5 lines) in factory/manager/watcher.py:507"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a76c0c3838a65f98", "name": "Commented-code block (10 lines) in factory/manager/detectors/placeholder_prompts.py:74", "shortDescription": {"text": "Commented-code block (10 lines) in factory/manager/detectors/placeholder_prompts.py:74"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d7bfda7aa6de4b2a", "name": "Commented-code block (6 lines) in factory/manager/detectors/stalled_stories.py:257", "shortDescription": {"text": "Commented-code block (6 lines) in factory/manager/detectors/stalled_stories.py:257"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a2c0b5e0f31a33e1", "name": "Commented-code block (5 lines) in factory/webhook/openhands_events.py:56", "shortDescription": {"text": "Commented-code block (5 lines) in factory/webhook/openhands_events.py:56"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0004cbce50cfdf48", "name": "Commented-code block (6 lines) in factory/webhook/github.py:118", "shortDescription": {"text": "Commented-code block (6 lines) in factory/webhook/github.py:118"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c6c9bbf0604ea8c0", "name": "Commented-code block (6 lines) in factory/tui/app.py:393", "shortDescription": {"text": "Commented-code block (6 lines) in factory/tui/app.py:393"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7d6004ab8f28a637", "name": "Commented-code block (6 lines) in factory/backpressure/validator.py:35", "shortDescription": {"text": "Commented-code block (6 lines) in factory/backpressure/validator.py:35"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-64f01a76d25af6e8", "name": "Commented-code block (5 lines) in factory/deploy/orchestrator.py:617", "shortDescription": {"text": "Commented-code block (5 lines) in factory/deploy/orchestrator.py:617"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2af4368d8f11f2f8", "name": "Commented-code block (6 lines) in factory/chain/scheduled_tasks.py:355", "shortDescription": {"text": "Commented-code block (6 lines) in factory/chain/scheduled_tasks.py:355"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-099da5b95c157578", "name": "Commented-code block (10 lines) in factory/chain/auto_merge.py:195", "shortDescription": {"text": "Commented-code block (10 lines) in factory/chain/auto_merge.py:195"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5d34b2e55cba91a1", "name": "Commented-code block (6 lines) in factory/chain/worktree.py:143", "shortDescription": {"text": "Commented-code block (6 lines) in factory/chain/worktree.py:143"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d1794f20856eae82", "name": "Commented-code block (6 lines) in factory/chain/factory_improver_apply.py:388", "shortDescription": {"text": "Commented-code block (6 lines) in factory/chain/factory_improver_apply.py:388"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-43bd054d66a205c2", "name": "Commented-code block (7 lines) in factory/chain/orchestrator.py:88", "shortDescription": {"text": "Commented-code block (7 lines) in factory/chain/orchestrator.py:88"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-75d678baf3d1f011", "name": "Commented-code block (5 lines) in factory/chain/rollback.py:176", "shortDescription": {"text": "Commented-code block (5 lines) in factory/chain/rollback.py:176"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d59542d797bed7f0", "name": "Network/subprocess call without timeout or try/except \u2014 factory/chain/rollback.py:161", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 factory/chain/rollback.py:161"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7abe43f41652cccd", "name": "Commented-code block (6 lines) in factory/chain/pm_sync.py:94", "shortDescription": {"text": "Commented-code block (6 lines) in factory/chain/pm_sync.py:94"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b2e1a977bd4653ea", "name": "Commented-code block (10 lines) in factory/chain/handlers.py:669", "shortDescription": {"text": "Commented-code block (10 lines) in factory/chain/handlers.py:669"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8e293eaba8aa4b41", "name": "Network/subprocess call without timeout or try/except \u2014 factory/chain/handlers.py:2584", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 factory/chain/handlers.py:2584"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b2bc9a6c397d2079", "name": "Commented-code block (5 lines) in factory/chain/state_machine.py:73", "shortDescription": {"text": "Commented-code block (5 lines) in factory/chain/state_machine.py:73"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1362013d2b49c975", "name": "Commented-code block (6 lines) in factory/chain/factory_improver.py:43", "shortDescription": {"text": "Commented-code block (6 lines) in factory/chain/factory_improver.py:43"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0d4c1c64bcbcda30", "name": "Commented-code block (5 lines) in factory/chain/branch.py:180", "shortDescription": {"text": "Commented-code block (5 lines) in factory/chain/branch.py:180"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9f286e51c0af0408", "name": "Commented-code block (11 lines) in factory/chain/gates/evaluator.py:31", "shortDescription": {"text": "Commented-code block (11 lines) in factory/chain/gates/evaluator.py:31"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6186a0e2bac8cf90", "name": "Commented-code block (6 lines) in factory/chain/gates/tests_meaningful.py:31", "shortDescription": {"text": "Commented-code block (6 lines) in factory/chain/gates/tests_meaningful.py:31"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-40a9df2b6b986089", "name": "Commented-code block (5 lines) in factory/chain/gates/flow_verified.py:81", "shortDescription": {"text": "Commented-code block (5 lines) in factory/chain/gates/flow_verified.py:81"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6d1a5f9d3e1a76d8", "name": "Commented-code block (6 lines) in factory/observability/estimator.py:41", "shortDescription": {"text": "Commented-code block (6 lines) in factory/observability/estimator.py:41"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-eb944cd03ca1e3ab", "name": "Commented-code block (5 lines) in factory/providers/azure_foundry.py:113", "shortDescription": {"text": "Commented-code block (5 lines) in factory/providers/azure_foundry.py:113"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ad1f2c0971b89ce0", "name": "10 env vars used in code but missing from .env.example", "shortDescription": {"text": "10 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `AZURE_AI_API_BASE`, `AZURE_AI_API_VERSION`, `AZURE_API_BASE`, `EDITOR`, `FACTORY_PROVIDER`, `FACTORY_SANDBOX_TIMEOUT_S`, `FACTORY_SHARD`, `FACTORY_STATE_ROOT` + 2 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49c98f7cedd9c977", "name": "Near-duplicate function bodies in 4 places", "shortDescription": {"text": "Near-duplicate function bodies in 4 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nfactory/manager/self_context.py:text_run, factory/manager/summarizer.py:text_run, factory/manager/diagnostician.py:text_run, factory/manager/watcher.py:text_run\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nfactory/chain/worktree.py:ensure_worktree_for_story, factory/chain/worktree.py:remove_worktree_for_story\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nfactory/chain/ux_auditor.py:ux_auditor_tick, factory/chain/bug_hunter.py:bug_hunter_tick, factory/chain/security.py:security_tick\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-76a2f6818267a9a8", "name": "Near-duplicate function bodies in 8 places", "shortDescription": {"text": "Near-duplicate function bodies in 8 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nfactory/chain/handlers.py:handle_sm, factory/chain/handlers.py:handle_dev, factory/chain/handlers.py:handle_review, factory/chain/handlers.py:handle_tech_writer\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-35a0bdbbf820a339", "name": "Unused endpoint: POST /webhook/github", "shortDescription": {"text": "Unused endpoint: POST /webhook/github"}, "fullDescription": {"text": "`factory/webhook/github.py` declares `POST /webhook/github` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/23084"}, "properties": {"repository": "xvanov/software-factory", "repoUrl": "https://github.com/xvanov/software-factory", "branch": "main"}, "results": [{"ruleId": "scanner-df5b93a53306a33c", "level": "note", "message": {"text": "Possibly dead Python function: compose"}, "properties": {"repobilityId": "e8baae2c9d6dad8b", "scanner": "scanner-primary", "fingerprint": "df5b93a53306a33c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "factory/tui/app.py:379"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-50a829ee01ceed13", "level": "note", "message": {"text": "Possibly dead Python function: action_recompute_baselines"}, "properties": {"repobilityId": "29f96fcbb9b0c68e", "scanner": "scanner-primary", "fingerprint": "50a829ee01ceed13", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "factory/tui/app.py:408"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2a6ca8c473701362", "level": "note", "message": {"text": "Possibly dead Python function: validate_slug"}, "properties": {"repobilityId": "cd368cd484887d8c", "scanner": "scanner-primary", "fingerprint": "2a6ca8c473701362", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "factory/directions/parser.py:295"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d2d1ecc1fc35d857", "level": "note", "message": {"text": "Possibly dead Python function: bump_cursor"}, "properties": {"repobilityId": "ea18635d923ae5ae", "scanner": "scanner-primary", "fingerprint": "d2d1ecc1fc35d857", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "factory/directions/watcher.py:120"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c15cf720a3497bb6", "level": "warning", "message": {"text": "Privileged port 13 in use"}, "properties": {"repobilityId": "79d721e4d6f64798", "scanner": "scanner-primary", "fingerprint": "c15cf720a3497bb6", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/sacrifice/directions/012-align-chat-affordances-with-current-implementation/state.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f5ba2dd9df873cb2", "level": "warning", "message": {"text": "Privileged port 18 in use"}, "properties": {"repobilityId": "2d7b5e7d9c158e43", "scanner": "scanner-primary", "fingerprint": "f5ba2dd9df873cb2", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/sacrifice/directions/009-chat-goal-creation/state.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9817e7cebd62ee78", "level": "warning", "message": {"text": "Privileged port 23 in use"}, "properties": {"repobilityId": "a1230e3dfc4becfa", "scanner": "scanner-primary", "fingerprint": "9817e7cebd62ee78", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/sacrifice/directions/009-chat-goal-creation/state.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b4c1614a4ec5226b", "level": "warning", "message": {"text": "Privileged port 24 in use"}, "properties": {"repobilityId": "a6356ba91a17fcb8", "scanner": "scanner-primary", "fingerprint": "b4c1614a4ec5226b", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/sacrifice/directions/009-chat-goal-creation/state.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ba6bf0545f87e1be", "level": "warning", "message": {"text": "Privileged port 30 in use"}, "properties": {"repobilityId": "54f172e7d16fc662", "scanner": "scanner-primary", "fingerprint": "ba6bf0545f87e1be", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/sacrifice/directions/005-bootstrap-context/state.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3c3b92cda3101982", "level": "warning", "message": {"text": "Privileged port 17 in use"}, "properties": {"repobilityId": "0bf38fb8f89ec589", "scanner": "scanner-primary", "fingerprint": "3c3b92cda3101982", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/sacrifice/directions/005-bootstrap-context/state.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fda9adad13202848", "level": "warning", "message": {"text": "Privileged port 40 in use"}, "properties": {"repobilityId": "28c59d470d4929c6", "scanner": "scanner-primary", "fingerprint": "fda9adad13202848", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/sacrifice/directions/005-bootstrap-context/state.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4ceeefc85746ec6a", "level": "warning", "message": {"text": "Privileged port 26 in use"}, "properties": {"repobilityId": "9c5e4d9c5edd9bd2", "scanner": "scanner-primary", "fingerprint": "4ceeefc85746ec6a", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/sacrifice/directions/002-add-healthz-endpoint/state.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fd815f45da0966e2", "level": "warning", "message": {"text": "Privileged port 20 in use"}, "properties": {"repobilityId": "a59f3e53d617e0f8", "scanner": "scanner-primary", "fingerprint": "fd815f45da0966e2", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/sacrifice/directions/004-vague-thought/state.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d0201598c49bb78c", "level": "warning", "message": {"text": "Privileged port 32 in use"}, "properties": {"repobilityId": "20c0fabc691cdde4", "scanner": "scanner-primary", "fingerprint": "d0201598c49bb78c", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/sacrifice/directions/004-vague-thought/state.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-af4cc98cf621b5ee", "level": "warning", "message": {"text": "Privileged port 33 in use"}, "properties": {"repobilityId": "f08e29b4b53f7301", "scanner": "scanner-primary", "fingerprint": "af4cc98cf621b5ee", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/sacrifice/directions/004-vague-thought/state.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4b9ada079e04859f", "level": "warning", "message": {"text": "Privileged port 34 in use"}, "properties": {"repobilityId": "2febb579b1c7080d", "scanner": "scanner-primary", "fingerprint": "4b9ada079e04859f", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/sacrifice/directions/004-vague-thought/state.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c5c619f2e06fcfa6", "level": "warning", "message": {"text": "Privileged port 15 in use"}, "properties": {"repobilityId": "3340f9a170f285cd", "scanner": "scanner-primary", "fingerprint": "c5c619f2e06fcfa6", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/sacrifice/directions/014-reduce-dead-end-states-in-goal-type-selection/state.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ea79d58990f24cfb", "level": "warning", "message": {"text": "Privileged port 16 in use"}, "properties": {"repobilityId": "d31009168c502ace", "scanner": "scanner-primary", "fingerprint": "ea79d58990f24cfb", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/factory/directions/001-factory-management-system/state.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-ae197f5b5fdb2450", "level": "warning", "message": {"text": "Insecure pattern 'subprocess_shell_true' in factory/runner.py:648"}, "properties": {"repobilityId": "14767b35ac2d4932", "scanner": "scanner-primary", "fingerprint": "ae197f5b5fdb2450", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "subprocess_shell_true"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "factory/runner.py"}, "region": {"startLine": 648}}}]}, {"ruleId": "scanner-796aaf70ec062a5a", "level": "warning", "message": {"text": "Insecure pattern 'subprocess_shell_true' in factory/manager/circuit_breaker.py:247"}, "properties": {"repobilityId": "f789a4eddffcf9c3", "scanner": "scanner-primary", "fingerprint": "796aaf70ec062a5a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "subprocess_shell_true"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "factory/manager/circuit_breaker.py"}, "region": {"startLine": 247}}}]}, {"ruleId": "scanner-138f12eebca27317", "level": "warning", "message": {"text": "Insecure pattern 'subprocess_shell_true' in factory/deploy/runner.py:125"}, "properties": {"repobilityId": "3e2a9e0f6778dec4", "scanner": "scanner-primary", "fingerprint": "138f12eebca27317", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "subprocess_shell_true"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "factory/deploy/runner.py"}, "region": {"startLine": 125}}}]}, {"ruleId": "scanner-b7209f1233e2e1fb", "level": "warning", "message": {"text": "Insecure pattern 'subprocess_shell_true' in factory/chain/scheduled_tasks.py:156"}, "properties": {"repobilityId": "9bd874c3b9fc3f84", "scanner": "scanner-primary", "fingerprint": "b7209f1233e2e1fb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "subprocess_shell_true"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "factory/chain/scheduled_tasks.py"}, "region": {"startLine": 156}}}]}, {"ruleId": "scanner-ab5f9929f5893cf4", "level": "warning", "message": {"text": "Insecure pattern 'subprocess_shell_true' in factory/chain/gates/evaluator.py:105"}, "properties": {"repobilityId": "40eaecacc26d6b0a", "scanner": "scanner-primary", "fingerprint": "ab5f9929f5893cf4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "subprocess_shell_true"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "factory/chain/gates/evaluator.py"}, "region": {"startLine": 105}}}]}, {"ruleId": "scanner-7efbda965f283c17", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "56929525eac9a554", "scanner": "scanner-primary", "fingerprint": "7efbda965f283c17", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-7efbda965f283c17", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cd843b74d3963b06", "scanner": "scanner-primary", "fingerprint": "7efbda965f283c17", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-7efbda965f283c17", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "14d8af1ae0295036", "scanner": "scanner-primary", "fingerprint": "7efbda965f283c17", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test.yml"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-5876393a95bc2175", "level": "note", "message": {"text": "Very large file: factory/cli.py (2900 lines)"}, "properties": {"repobilityId": "b940eab94791afa3", "scanner": "scanner-primary", "fingerprint": "5876393a95bc2175", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-33506fe31c2974e9", "level": "note", "message": {"text": "Very large file: factory/runner.py (1600 lines)"}, "properties": {"repobilityId": "8691e10ddadedcfb", "scanner": "scanner-primary", "fingerprint": "33506fe31c2974e9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-1d40c25cd1c8dee9", "level": "note", "message": {"text": "Very large file: factory/chain/handlers.py (2822 lines)"}, "properties": {"repobilityId": "114175f4de266e3b", "scanner": "scanner-primary", "fingerprint": "1d40c25cd1c8dee9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "c449b7f49edf9095", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "0fb47998ec8032da", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "6fee28df4574233c", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "74e1510b46f1be1d", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "bb685df7aa0473ea", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "36a352de85cc5551", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "7d189c1bb897a8b0", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-f7ba31c0a6ea685c", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/test_app_gates_config.py:21"}, "properties": {"repobilityId": "af006a90decfb271", "scanner": "scanner-primary", "fingerprint": "f7ba31c0a6ea685c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4b1bfb0ae5b82be9", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/test_handler_tech_writer.py:21"}, "properties": {"repobilityId": "b2d08b6ee7001c3b", "scanner": "scanner-primary", "fingerprint": "4b1bfb0ae5b82be9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ae59ad457bdb72b3", "level": "note", "message": {"text": "Legacy-named symbol `t_very_old` in tests/manager/test_watcher.py:320"}, "properties": {"repobilityId": "5eaa320251a3e749", "scanner": "scanner-primary", "fingerprint": "ae59ad457bdb72b3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-050c64d8b41d4acd", "level": "note", "message": {"text": "Legacy-named symbol `too_old` in tests/manager/detectors/test_placeholder_prompts.py:54"}, "properties": {"repobilityId": "86fd378e64aa4155", "scanner": "scanner-primary", "fingerprint": "050c64d8b41d4acd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-c1805e6117d6aeab", "level": "none", "message": {"text": "Commented-code block (5 lines) in factory/cli.py:507"}, "properties": {"repobilityId": "b59812ae6b7388a9", "scanner": "scanner-primary", "fingerprint": "c1805e6117d6aeab", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-39a6df857d4b8e4c", "level": "none", "message": {"text": "Commented-code block (7 lines) in factory/app_config.py:65"}, "properties": {"repobilityId": "c1f1b4345664bc1e", "scanner": "scanner-primary", "fingerprint": "39a6df857d4b8e4c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-dbbc6eaa1a697539", "level": "none", "message": {"text": "Commented-code block (10 lines) in factory/runner.py:38"}, "properties": {"repobilityId": "b61aeaec1a20170d", "scanner": "scanner-primary", "fingerprint": "dbbc6eaa1a697539", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b69800cbb6a45b84", "level": "none", "message": {"text": "Commented-code block (6 lines) in factory/settings/spend.py:58"}, "properties": {"repobilityId": "bf250c708f6d05f6", "scanner": "scanner-primary", "fingerprint": "b69800cbb6a45b84", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7eab3a021dee1227", "level": "none", "message": {"text": "Commented-code block (7 lines) in factory/manager/diagnostician.py:323"}, "properties": {"repobilityId": "acea5328ad77edc8", "scanner": "scanner-primary", "fingerprint": "7eab3a021dee1227", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cfafaf5e94d138d9", "level": "none", "message": {"text": "Commented-code block (10 lines) in factory/manager/apply.py:101"}, "properties": {"repobilityId": "8dbdce239a7e6390", "scanner": "scanner-primary", "fingerprint": "cfafaf5e94d138d9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bd2cc8fa6b0b48e2", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 factory/manager/circuit_breaker.py:324"}, "properties": {"repobilityId": "85f3c0e81407b86e", "scanner": "scanner-primary", "fingerprint": "bd2cc8fa6b0b48e2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-dfb656ee98fcfc8c", "level": "none", "message": {"text": "Commented-code block (7 lines) in factory/manager/halt.py:30"}, "properties": {"repobilityId": "b58a1d5611f85342", "scanner": "scanner-primary", "fingerprint": "dfb656ee98fcfc8c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-866ddcc64604d863", "level": "none", "message": {"text": "Commented-code block (5 lines) in factory/manager/signals.py:48"}, "properties": {"repobilityId": "67ecf8684d48929a", "scanner": "scanner-primary", "fingerprint": "866ddcc64604d863", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ace8023ff5fceaf8", "level": "none", "message": {"text": "Commented-code block (5 lines) in factory/manager/watcher.py:507"}, "properties": {"repobilityId": "a5af87ab9ba6e44d", "scanner": "scanner-primary", "fingerprint": "ace8023ff5fceaf8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a76c0c3838a65f98", "level": "none", "message": {"text": "Commented-code block (10 lines) in factory/manager/detectors/placeholder_prompts.py:74"}, "properties": {"repobilityId": "cd77260737009554", "scanner": "scanner-primary", "fingerprint": "a76c0c3838a65f98", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d7bfda7aa6de4b2a", "level": "none", "message": {"text": "Commented-code block (6 lines) in factory/manager/detectors/stalled_stories.py:257"}, "properties": {"repobilityId": "8b8867039728467c", "scanner": "scanner-primary", "fingerprint": "d7bfda7aa6de4b2a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a2c0b5e0f31a33e1", "level": "none", "message": {"text": "Commented-code block (5 lines) in factory/webhook/openhands_events.py:56"}, "properties": {"repobilityId": "e0c2a1ffcc66e7fb", "scanner": "scanner-primary", "fingerprint": "a2c0b5e0f31a33e1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0004cbce50cfdf48", "level": "none", "message": {"text": "Commented-code block (6 lines) in factory/webhook/github.py:118"}, "properties": {"repobilityId": "1a2547b4c17d7fc9", "scanner": "scanner-primary", "fingerprint": "0004cbce50cfdf48", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c6c9bbf0604ea8c0", "level": "none", "message": {"text": "Commented-code block (6 lines) in factory/tui/app.py:393"}, "properties": {"repobilityId": "19ac2d5369f4d492", "scanner": "scanner-primary", "fingerprint": "c6c9bbf0604ea8c0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7d6004ab8f28a637", "level": "none", "message": {"text": "Commented-code block (6 lines) in factory/backpressure/validator.py:35"}, "properties": {"repobilityId": "cef508ddf1ea7d70", "scanner": "scanner-primary", "fingerprint": "7d6004ab8f28a637", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-64f01a76d25af6e8", "level": "none", "message": {"text": "Commented-code block (5 lines) in factory/deploy/orchestrator.py:617"}, "properties": {"repobilityId": "43018a4a3a096b34", "scanner": "scanner-primary", "fingerprint": "64f01a76d25af6e8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2af4368d8f11f2f8", "level": "none", "message": {"text": "Commented-code block (6 lines) in factory/chain/scheduled_tasks.py:355"}, "properties": {"repobilityId": "3cd08be766823169", "scanner": "scanner-primary", "fingerprint": "2af4368d8f11f2f8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-099da5b95c157578", "level": "none", "message": {"text": "Commented-code block (10 lines) in factory/chain/auto_merge.py:195"}, "properties": {"repobilityId": "cea348ea1dfc827f", "scanner": "scanner-primary", "fingerprint": "099da5b95c157578", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5d34b2e55cba91a1", "level": "none", "message": {"text": "Commented-code block (6 lines) in factory/chain/worktree.py:143"}, "properties": {"repobilityId": "c1b2472b5a22b667", "scanner": "scanner-primary", "fingerprint": "5d34b2e55cba91a1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d1794f20856eae82", "level": "none", "message": {"text": "Commented-code block (6 lines) in factory/chain/factory_improver_apply.py:388"}, "properties": {"repobilityId": "061232184cfe2e3b", "scanner": "scanner-primary", "fingerprint": "d1794f20856eae82", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-43bd054d66a205c2", "level": "none", "message": {"text": "Commented-code block (7 lines) in factory/chain/orchestrator.py:88"}, "properties": {"repobilityId": "d8a3c8e42d3a0475", "scanner": "scanner-primary", "fingerprint": "43bd054d66a205c2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-75d678baf3d1f011", "level": "none", "message": {"text": "Commented-code block (5 lines) in factory/chain/rollback.py:176"}, "properties": {"repobilityId": "702d9376267449dc", "scanner": "scanner-primary", "fingerprint": "75d678baf3d1f011", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d59542d797bed7f0", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 factory/chain/rollback.py:161"}, "properties": {"repobilityId": "295119c5752b4576", "scanner": "scanner-primary", "fingerprint": "d59542d797bed7f0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-7abe43f41652cccd", "level": "none", "message": {"text": "Commented-code block (6 lines) in factory/chain/pm_sync.py:94"}, "properties": {"repobilityId": "763eaa057bc4c2a1", "scanner": "scanner-primary", "fingerprint": "7abe43f41652cccd", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b2e1a977bd4653ea", "level": "none", "message": {"text": "Commented-code block (10 lines) in factory/chain/handlers.py:669"}, "properties": {"repobilityId": "f633bed7af667ad8", "scanner": "scanner-primary", "fingerprint": "b2e1a977bd4653ea", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8e293eaba8aa4b41", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 factory/chain/handlers.py:2584"}, "properties": {"repobilityId": "f894c18d82b8aea9", "scanner": "scanner-primary", "fingerprint": "8e293eaba8aa4b41", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b2bc9a6c397d2079", "level": "none", "message": {"text": "Commented-code block (5 lines) in factory/chain/state_machine.py:73"}, "properties": {"repobilityId": "0514dda84d65daf3", "scanner": "scanner-primary", "fingerprint": "b2bc9a6c397d2079", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1362013d2b49c975", "level": "none", "message": {"text": "Commented-code block (6 lines) in factory/chain/factory_improver.py:43"}, "properties": {"repobilityId": "1928d40f61ca3c5c", "scanner": "scanner-primary", "fingerprint": "1362013d2b49c975", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0d4c1c64bcbcda30", "level": "none", "message": {"text": "Commented-code block (5 lines) in factory/chain/branch.py:180"}, "properties": {"repobilityId": "f4c3edc38415ad00", "scanner": "scanner-primary", "fingerprint": "0d4c1c64bcbcda30", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9f286e51c0af0408", "level": "none", "message": {"text": "Commented-code block (11 lines) in factory/chain/gates/evaluator.py:31"}, "properties": {"repobilityId": "7fa4392d12a08710", "scanner": "scanner-primary", "fingerprint": "9f286e51c0af0408", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6186a0e2bac8cf90", "level": "none", "message": {"text": "Commented-code block (6 lines) in factory/chain/gates/tests_meaningful.py:31"}, "properties": {"repobilityId": "705b7c0115f68143", "scanner": "scanner-primary", "fingerprint": "6186a0e2bac8cf90", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-40a9df2b6b986089", "level": "none", "message": {"text": "Commented-code block (5 lines) in factory/chain/gates/flow_verified.py:81"}, "properties": {"repobilityId": "199b5af8fa4dd67b", "scanner": "scanner-primary", "fingerprint": "40a9df2b6b986089", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6d1a5f9d3e1a76d8", "level": "none", "message": {"text": "Commented-code block (6 lines) in factory/observability/estimator.py:41"}, "properties": {"repobilityId": "99e8e01a1403e1fa", "scanner": "scanner-primary", "fingerprint": "6d1a5f9d3e1a76d8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-eb944cd03ca1e3ab", "level": "none", "message": {"text": "Commented-code block (5 lines) in factory/providers/azure_foundry.py:113"}, "properties": {"repobilityId": "fa7ddce8c342911e", "scanner": "scanner-primary", "fingerprint": "eb944cd03ca1e3ab", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ad1f2c0971b89ce0", "level": "note", "message": {"text": "10 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "3bfdc60c61f1870e", "scanner": "scanner-primary", "fingerprint": "ad1f2c0971b89ce0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "ebd1b4ce32fa7b2f", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "9d34d617c765acef", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "facfb2c6c96db68e", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-76a2f6818267a9a8", "level": "note", "message": {"text": "Near-duplicate function bodies in 8 places"}, "properties": {"repobilityId": "bdafc21a1a026bc4", "scanner": "scanner-primary", "fingerprint": "76a2f6818267a9a8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "48d64e236d93af6d", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "bc08ed174ed7b7d2", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-35a0bdbbf820a339", "level": "note", "message": {"text": "Unused endpoint: POST /webhook/github"}, "properties": {"repobilityId": "eaec80052da8e372", "scanner": "scanner-primary", "fingerprint": "35a0bdbbf820a339", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}