{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-f9764f1f43f05918", "name": "Possibly dead Python function: run_agent", "shortDescription": {"text": "Possibly dead Python function: run_agent"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c9c6a607d4cba149", "name": "Possibly dead Python function: all_completed", "shortDescription": {"text": "Possibly dead Python function: all_completed"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4f8dc51d581d0838", "name": "Possibly dead Python function: processor", "shortDescription": {"text": "Possibly dead Python function: processor"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-848f207a817ec631", "name": "Possibly dead Python function: all_lifecycles", "shortDescription": {"text": "Possibly dead Python function: all_lifecycles"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b6cb0f06a3ff7cbd", "name": "Possibly dead Python function: agent_info", "shortDescription": {"text": "Possibly dead Python function: agent_info"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b32335e299ab4c2d", "name": "Possibly dead Python function: scripted_model", "shortDescription": {"text": "Possibly dead Python function: scripted_model"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f34475594117b991", "name": "Possibly dead Python function: do_POST", "shortDescription": {"text": "Possibly dead Python function: do_POST"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c5e989ad16ae6994", "name": "Possibly dead Python function: log_message", "shortDescription": {"text": "Possibly dead Python function: log_message"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-840167490dc6309a", "name": "Possibly dead Python function: send", "shortDescription": {"text": "Possibly dead Python function: send"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd59e8187671553e", "name": "React Flow edge with `label=` but no project-wide edge-label CSS override \u2014 frontend/src/canvas/graphMapping.ts:24", "shortDescription": {"text": "React Flow edge with `label=` but no project-wide edge-label CSS override \u2014 frontend/src/canvas/graphMapping.ts:24"}, "fullDescription": {"text": "React Flow edge labels render with a white rectangle behind the text by default, which scatters bright boxes across a dark canvas. Either drop the label, or override `.react-flow__edge-textbg` and `.react-flow__edge-text` in your stylesheet.\n\nWhy: P-H in CHECKLIST.md \u2014 vendor edge labels bleed white through a dark canvas.\nRule id: fq.edge-label.no-bg"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b69a1568cf27eb0d", "name": "Insecure pattern 'subprocess_shell_true' in backend/agents/tools.py:131", "shortDescription": {"text": "Insecure pattern 'subprocess_shell_true' in backend/agents/tools.py:131"}, "fullDescription": {"text": "Found a known-risky pattern (subprocess_shell_true). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e2971198a5b27fbb", "name": "Insecure pattern 'subprocess_shell_true' in backend/runtime/tasks.py:176", "shortDescription": {"text": "Insecure pattern 'subprocess_shell_true' in backend/runtime/tasks.py:176"}, "fullDescription": {"text": "Found a known-risky pattern (subprocess_shell_true). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 18 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 14 placeholder/mock markers across 10 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing ci. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bea357a6497a2d5d", "name": "Agent authority lacks a verifier contract: CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7fa541a9aa7bb868", "name": "Agent authority lacks a verifier contract: tests/CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: tests/CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6086295b71e12fa8", "name": "Agent authority lacks a verifier contract: backend/CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: backend/CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1d67cc3e81934bce", "name": "Agent authority lacks a verifier contract: backend/agents/CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: backend/agents/CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4fa24b5abd883da3", "name": "Agent authority lacks a verifier contract: backend/api/CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: backend/api/CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cf51bf9d2f0624dd", "name": "Agent authority lacks a verifier contract: backend/runtime/CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: backend/runtime/CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bb1e297f41887d29", "name": "Agent authority lacks a verifier contract: frontend/CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: frontend/CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bec1df242473fbfe", "name": "Network/subprocess call without timeout or try/except \u2014 backend/agents/tools.py:131", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 backend/agents/tools.py:131"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-124144fc2e7e18c4", "name": "Commented-code block (5 lines) in backend/providers/lmstudio.py:49", "shortDescription": {"text": "Commented-code block (5 lines) in backend/providers/lmstudio.py:49"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bad45350ba021336", "name": "Network/subprocess call without timeout or try/except \u2014 backend/runtime/tasks.py:176", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 backend/runtime/tasks.py:176"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-63b75b16d0736d2c", "name": "Commented-code block (5 lines) in backend/runtime/sessions.py:99", "shortDescription": {"text": "Commented-code block (5 lines) in backend/runtime/sessions.py:99"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c58b733767347700", "name": "Legacy-named symbol `model_copy` in backend/runtime/workers.py:63", "shortDescription": {"text": "Legacy-named symbol `model_copy` in backend/runtime/workers.py:63"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-39b0d8d79340309b", "name": "Commented-code block (6 lines) in backend/harness/opencode/config.py:85", "shortDescription": {"text": "Commented-code block (6 lines) in backend/harness/opencode/config.py:85"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3467f60fb83221a0", "name": "Commented-code block (5 lines) in backend/harness/opencode/harness.py:387", "shortDescription": {"text": "Commented-code block (5 lines) in backend/harness/opencode/harness.py:387"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8e782f630a6c9a9d", "name": "Commented-code block (7 lines) in backend/harness/opencode/tools/ask_agent.ts:3", "shortDescription": {"text": "Commented-code block (7 lines) in backend/harness/opencode/tools/ask_agent.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6bfc78b107d73300", "name": "`fetch()` without try/.catch or AbortSignal \u2014 backend/harness/opencode/tools/ask_agent.ts:21", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 backend/harness/opencode/tools/ask_agent.ts:21"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8d447074daca752d", "name": "Commented-code block (5 lines) in scripts/verify_ui.py:255", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/verify_ui.py:255"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4287c4fd5e7e02a3", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/verify_ui.py:223", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/verify_ui.py:223"}, "fullDescription": {"text": "`urllib.request.urlopen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4c303d36b90d33a9", "name": "Stub function `log_message` (body is just `pass`/`return`) \u2014 specs/opencode-smoke/stub.py:24", "shortDescription": {"text": "Stub function `log_message` (body is just `pass`/`return`) \u2014 specs/opencode-smoke/stub.py:24"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f59ec02eedc7f29a", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/lib/api.ts:48", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/lib/api.ts:48"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dd1844e538ed846f", "name": "Commented-code block (5 lines) in frontend/src/canvas/Canvas.tsx:42", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/canvas/Canvas.tsx:42"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-04af76dcf4a45fdb", "name": "Commented-code block (5 lines) in frontend/src/canvas/graphMapping.ts:1", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/canvas/graphMapping.ts:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-18c4c424fa373a41", "name": "Commented-code block (12 lines) in frontend/src/canvas/FloatingEdge.tsx:3", "shortDescription": {"text": "Commented-code block (12 lines) in frontend/src/canvas/FloatingEdge.tsx:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbackend/providers/lmstudio.py:build_lmstudio_model, backend/providers/lmstudio.py:build\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d0b9806a09cf7fc8", "name": "FastAPI POST `answer_question` without auth dependency \u2014 backend/api/questions.py:19", "shortDescription": {"text": "FastAPI POST `answer_question` without auth dependency \u2014 backend/api/questions.py:19"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-53ae1be32b76f1ab", "name": "FastAPI POST `create_task` without auth dependency \u2014 backend/api/tasks.py:27", "shortDescription": {"text": "FastAPI POST `create_task` without auth dependency \u2014 backend/api/tasks.py:27"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-53b1d612c163eaf2", "name": "FastAPI POST `retry_task` without auth dependency \u2014 backend/api/tasks.py:50", "shortDescription": {"text": "FastAPI POST `retry_task` without auth dependency \u2014 backend/api/tasks.py:50"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8d63281bcd2af3b0", "name": "FastAPI POST `create_team` without auth dependency \u2014 backend/api/teams.py:18", "shortDescription": {"text": "FastAPI POST `create_team` without auth dependency \u2014 backend/api/teams.py:18"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bcef616ab71f62ec", "name": "FastAPI PUT `put_team_graph` without auth dependency \u2014 backend/api/teams.py:42", "shortDescription": {"text": "FastAPI PUT `put_team_graph` without auth dependency \u2014 backend/api/teams.py:42"}, "fullDescription": {"text": "`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-67721d7094fcad8e", "name": "FastAPI POST `rename_team` without auth dependency \u2014 backend/api/teams.py:46", "shortDescription": {"text": "FastAPI POST `rename_team` without auth dependency \u2014 backend/api/teams.py:46"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d34b455df2714af3", "name": "FastAPI POST `launch_session` without auth dependency \u2014 backend/api/sessions.py:22", "shortDescription": {"text": "FastAPI POST `launch_session` without auth dependency \u2014 backend/api/sessions.py:22"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c10ec43d2a88a9f6", "name": "FastAPI POST `resume_session` without auth dependency \u2014 backend/api/sessions.py:43", "shortDescription": {"text": "FastAPI POST `resume_session` without auth dependency \u2014 backend/api/sessions.py:43"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-047ddc9576e6aadd", "name": "FastAPI POST `set_mode` without auth dependency \u2014 backend/api/sessions.py:64", "shortDescription": {"text": "FastAPI POST `set_mode` without auth dependency \u2014 backend/api/sessions.py:64"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c239ed0f05b545fa", "name": "FastAPI POST `install` without auth dependency \u2014 backend/api/internal.py:23", "shortDescription": {"text": "FastAPI POST `install` without auth dependency \u2014 backend/api/internal.py:23"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e2a402d5e187e07c", "name": "FastAPI POST `run_agent` without auth dependency \u2014 backend/api/agents.py:20", "shortDescription": {"text": "FastAPI POST `run_agent` without auth dependency \u2014 backend/api/agents.py:20"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c60fa7c1ca18718a", "name": "FastAPI POST `interject_agent` without auth dependency \u2014 backend/api/agents.py:28", "shortDescription": {"text": "FastAPI POST `interject_agent` without auth dependency \u2014 backend/api/agents.py:28"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-162ac4ad17efd460", "name": "FastAPI POST `clear_agent_history` without auth dependency \u2014 backend/api/agents.py:49", "shortDescription": {"text": "FastAPI POST `clear_agent_history` without auth dependency \u2014 backend/api/agents.py:49"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d00bb7ebe21fce09", "name": "FastAPI POST `summarize_agent_history` without auth dependency \u2014 backend/api/agents.py:59", "shortDescription": {"text": "FastAPI POST `summarize_agent_history` without auth dependency \u2014 backend/api/agents.py:59"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-241cb49af252eaec", "name": "FastAPI POST `stop_agent` without auth dependency \u2014 backend/api/agents.py:73", "shortDescription": {"text": "FastAPI POST `stop_agent` without auth dependency \u2014 backend/api/agents.py:73"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cbbd1702e014928c", "name": "Unused endpoint: GET /api/questions", "shortDescription": {"text": "Unused endpoint: GET /api/questions"}, "fullDescription": {"text": "`backend/api/questions.py` declares `GET /api/questions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f90ccb675c5f41ed", "name": "Unused endpoint: POST /api/questions/{question_id}/answer", "shortDescription": {"text": "Unused endpoint: POST /api/questions/{question_id}/answer"}, "fullDescription": {"text": "`backend/api/questions.py` declares `POST /api/questions/{question_id}/answer` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cf16ae0930dc161a", "name": "Unused endpoint: GET /api/tasks", "shortDescription": {"text": "Unused endpoint: GET /api/tasks"}, "fullDescription": {"text": "`backend/api/tasks.py` declares `GET /api/tasks` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dd377e6beb63fde7", "name": "Unused endpoint: POST /api/tasks", "shortDescription": {"text": "Unused endpoint: POST /api/tasks"}, "fullDescription": {"text": "`backend/api/tasks.py` declares `POST /api/tasks` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-574e0277428b2c6c", "name": "Unused endpoint: GET /api/tasks/{task_id}", "shortDescription": {"text": "Unused endpoint: GET /api/tasks/{task_id}"}, "fullDescription": {"text": "`backend/api/tasks.py` declares `GET /api/tasks/{task_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0161de3ddcf05f6f", "name": "Unused endpoint: GET /api/teams/{team_id}", "shortDescription": {"text": "Unused endpoint: GET /api/teams/{team_id}"}, "fullDescription": {"text": "`backend/api/teams.py` declares `GET /api/teams/{team_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7f42d347d0de67e8", "name": "Unused endpoint: POST /api/teams/{team_id}/rename", "shortDescription": {"text": "Unused endpoint: POST /api/teams/{team_id}/rename"}, "fullDescription": {"text": "`backend/api/teams.py` declares `POST /api/teams/{team_id}/rename` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6b0e7f5976711316", "name": "Unused endpoint: GET /api/session", "shortDescription": {"text": "Unused endpoint: GET /api/session"}, "fullDescription": {"text": "`backend/api/sessions.py` declares `GET /api/session` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2e138a878848dcf7", "name": "Unused endpoint: POST /api/sessions/{session_id}/resume", "shortDescription": {"text": "Unused endpoint: POST /api/sessions/{session_id}/resume"}, "fullDescription": {"text": "`backend/api/sessions.py` declares `POST /api/sessions/{session_id}/resume` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7ece0a6f15c3e51c", "name": "Unused endpoint: POST /api/session/mode", "shortDescription": {"text": "Unused endpoint: POST /api/session/mode"}, "fullDescription": {"text": "`backend/api/sessions.py` declares `POST /api/session/mode` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fa65a91e1f52822d", "name": "Unused endpoint: GET /api/stats/usage/{agent_id}", "shortDescription": {"text": "Unused endpoint: GET /api/stats/usage/{agent_id}"}, "fullDescription": {"text": "`backend/api/stats.py` declares `GET /api/stats/usage/{agent_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-45ec9bddac3b08b5", "name": "Unused endpoint: POST /internal/ask_agent", "shortDescription": {"text": "Unused endpoint: POST /internal/ask_agent"}, "fullDescription": {"text": "`backend/api/internal.py` declares `POST /internal/ask_agent` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-43269e4e79c2e69e", "name": "Unused endpoint: GET /events", "shortDescription": {"text": "Unused endpoint: GET /events"}, "fullDescription": {"text": "`backend/api/agents.py` declares `GET /events` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d6ab117b48f63059", "name": "Unused endpoint: POST /api/agent/{agent_id}/run", "shortDescription": {"text": "Unused endpoint: POST /api/agent/{agent_id}/run"}, "fullDescription": {"text": "`backend/api/agents.py` declares `POST /api/agent/{agent_id}/run` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ba8c716ecdd87091", "name": "Unused endpoint: POST /api/agent/{agent_id}/interject", "shortDescription": {"text": "Unused endpoint: POST /api/agent/{agent_id}/interject"}, "fullDescription": {"text": "`backend/api/agents.py` declares `POST /api/agent/{agent_id}/interject` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-941b59e1b5a8c068", "name": "Unused endpoint: GET /api/agent/{agent_id}/history", "shortDescription": {"text": "Unused endpoint: GET /api/agent/{agent_id}/history"}, "fullDescription": {"text": "`backend/api/agents.py` declares `GET /api/agent/{agent_id}/history` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-14c195c86849eaa5", "name": "Unused endpoint: POST /api/agent/{agent_id}/history/clear", "shortDescription": {"text": "Unused endpoint: POST /api/agent/{agent_id}/history/clear"}, "fullDescription": {"text": "`backend/api/agents.py` declares `POST /api/agent/{agent_id}/history/clear` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e84a79aa8abe0fa8", "name": "Unused endpoint: POST /api/agent/{agent_id}/history/summarize", "shortDescription": {"text": "Unused endpoint: POST /api/agent/{agent_id}/history/summarize"}, "fullDescription": {"text": "`backend/api/agents.py` declares `POST /api/agent/{agent_id}/history/summarize` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6e7cc6e6c338492c", "name": "Unused endpoint: POST /api/agent/{agent_id}/stop", "shortDescription": {"text": "Unused endpoint: POST /api/agent/{agent_id}/stop"}, "fullDescription": {"text": "`backend/api/agents.py` declares `POST /api/agent/{agent_id}/stop` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-205e269e06ed0d72", "name": "Unused endpoint: GET /api/messages", "shortDescription": {"text": "Unused endpoint: GET /api/messages"}, "fullDescription": {"text": "`backend/api/agents.py` declares `GET /api/messages` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/25218"}, "properties": {"repository": "Daniele122898/agent-graphs", "repoUrl": "https://github.com/Daniele122898/agent-graphs", "branch": "main"}, "results": [{"ruleId": "scanner-f9764f1f43f05918", "level": "note", "message": {"text": "Possibly dead Python function: run_agent"}, "properties": {"repobilityId": "869a607d50b48872", "scanner": "scanner-primary", "fingerprint": "f9764f1f43f05918", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/wiring.py:94"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c9c6a607d4cba149", "level": "note", "message": {"text": "Possibly dead Python function: all_completed"}, "properties": {"repobilityId": "b6e09b5f3d081e6f", "scanner": "scanner-primary", "fingerprint": "c9c6a607d4cba149", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/agents/todos.py:48"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4f8dc51d581d0838", "level": "note", "message": {"text": "Possibly dead Python function: processor"}, "properties": {"repobilityId": "7d755f89c5693ca5", "scanner": "scanner-primary", "fingerprint": "4f8dc51d581d0838", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/agents/history.py:52"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-848f207a817ec631", "level": "note", "message": {"text": "Possibly dead Python function: all_lifecycles"}, "properties": {"repobilityId": "c3b5c447e21efa10", "scanner": "scanner-primary", "fingerprint": "848f207a817ec631", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/runtime/sessions.py:74"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b6cb0f06a3ff7cbd", "level": "note", "message": {"text": "Possibly dead Python function: agent_info"}, "properties": {"repobilityId": "5f45a09c275de8d9", "scanner": "scanner-primary", "fingerprint": "b6cb0f06a3ff7cbd", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/harness/opencode/client.py:68"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b32335e299ab4c2d", "level": "note", "message": {"text": "Possibly dead Python function: scripted_model"}, "properties": {"repobilityId": "7d10578ce8cc6c9f", "scanner": "scanner-primary", "fingerprint": "b32335e299ab4c2d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/scripted_backend.py:30"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f34475594117b991", "level": "note", "message": {"text": "Possibly dead Python function: do_POST"}, "properties": {"repobilityId": "53357410ca9379a9", "scanner": "scanner-primary", "fingerprint": "f34475594117b991", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "specs/opencode-smoke/stub.py:9"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c5e989ad16ae6994", "level": "note", "message": {"text": "Possibly dead Python function: log_message"}, "properties": {"repobilityId": "965f3150b4af5b2e", "scanner": "scanner-primary", "fingerprint": "c5e989ad16ae6994", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "specs/opencode-smoke/stub.py:24"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-840167490dc6309a", "level": "note", "message": {"text": "Possibly dead Python function: send"}, "properties": {"repobilityId": "1f3be5149448acbf", "scanner": "scanner-primary", "fingerprint": "840167490dc6309a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "specs/opencode-smoke/drive_question.py:18"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fd59e8187671553e", "level": "note", "message": {"text": "React Flow edge with `label=` but no project-wide edge-label CSS override \u2014 frontend/src/canvas/graphMapping.ts:24"}, "properties": {"repobilityId": "e0dcd395b3857bab", "scanner": "scanner-primary", "fingerprint": "fd59e8187671553e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.edge-label.no-bg"]}}, {"ruleId": "scanner-b69a1568cf27eb0d", "level": "error", "message": {"text": "Insecure pattern 'subprocess_shell_true' in backend/agents/tools.py:131"}, "properties": {"repobilityId": "8ccf8dc7a87494c5", "scanner": "scanner-primary", "fingerprint": "b69a1568cf27eb0d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "subprocess_shell_true"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/agents/tools.py"}, "region": {"startLine": 131}}}]}, {"ruleId": "scanner-e2971198a5b27fbb", "level": "error", "message": {"text": "Insecure pattern 'subprocess_shell_true' in backend/runtime/tasks.py:176"}, "properties": {"repobilityId": "448d3cb25114d1e5", "scanner": "scanner-primary", "fingerprint": "e2971198a5b27fbb", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "subprocess_shell_true"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/runtime/tasks.py"}, "region": {"startLine": 176}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "8763e6357d15642c", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "9b786407a7a65538", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "3bdad3f8dfb4d42c", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "597e8c58e4b4c283", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-bea357a6497a2d5d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: CLAUDE.md"}, "properties": {"repobilityId": "aae72df3934829ac", "scanner": "scanner-primary", "fingerprint": "bea357a6497a2d5d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7fa541a9aa7bb868", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: tests/CLAUDE.md"}, "properties": {"repobilityId": "db2f82b236546f3a", "scanner": "scanner-primary", "fingerprint": "7fa541a9aa7bb868", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6086295b71e12fa8", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: backend/CLAUDE.md"}, "properties": {"repobilityId": "4ae9c8b101d39a69", "scanner": "scanner-primary", "fingerprint": "6086295b71e12fa8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1d67cc3e81934bce", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: backend/agents/CLAUDE.md"}, "properties": {"repobilityId": "3cef9492c91ca842", "scanner": "scanner-primary", "fingerprint": "1d67cc3e81934bce", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/agents/CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4fa24b5abd883da3", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: backend/api/CLAUDE.md"}, "properties": {"repobilityId": "cdc90b3160f78574", "scanner": "scanner-primary", "fingerprint": "4fa24b5abd883da3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/api/CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cf51bf9d2f0624dd", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: backend/runtime/CLAUDE.md"}, "properties": {"repobilityId": "a1f3b1fdb5ed9473", "scanner": "scanner-primary", "fingerprint": "cf51bf9d2f0624dd", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/runtime/CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bb1e297f41887d29", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: frontend/CLAUDE.md"}, "properties": {"repobilityId": "b412ec9328c270d5", "scanner": "scanner-primary", "fingerprint": "bb1e297f41887d29", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bec1df242473fbfe", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 backend/agents/tools.py:131"}, "properties": {"repobilityId": "d99e6a259b4d3c05", "scanner": "scanner-primary", "fingerprint": "bec1df242473fbfe", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-124144fc2e7e18c4", "level": "none", "message": {"text": "Commented-code block (5 lines) in backend/providers/lmstudio.py:49"}, "properties": {"repobilityId": "20622df1795bfd9e", "scanner": "scanner-primary", "fingerprint": "124144fc2e7e18c4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bad45350ba021336", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 backend/runtime/tasks.py:176"}, "properties": {"repobilityId": "e60b17cccebb83ce", "scanner": "scanner-primary", "fingerprint": "bad45350ba021336", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-63b75b16d0736d2c", "level": "none", "message": {"text": "Commented-code block (5 lines) in backend/runtime/sessions.py:99"}, "properties": {"repobilityId": "e010c48a31a0904d", "scanner": "scanner-primary", "fingerprint": "63b75b16d0736d2c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c58b733767347700", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in backend/runtime/workers.py:63"}, "properties": {"repobilityId": "18c0369e206a8170", "scanner": "scanner-primary", "fingerprint": "c58b733767347700", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-39b0d8d79340309b", "level": "none", "message": {"text": "Commented-code block (6 lines) in backend/harness/opencode/config.py:85"}, "properties": {"repobilityId": "364b52483eb4a04c", "scanner": "scanner-primary", "fingerprint": "39b0d8d79340309b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3467f60fb83221a0", "level": "none", "message": {"text": "Commented-code block (5 lines) in backend/harness/opencode/harness.py:387"}, "properties": {"repobilityId": "7922ee2dbc17848c", "scanner": "scanner-primary", "fingerprint": "3467f60fb83221a0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8e782f630a6c9a9d", "level": "none", "message": {"text": "Commented-code block (7 lines) in backend/harness/opencode/tools/ask_agent.ts:3"}, "properties": {"repobilityId": "c55bd9c56b6bbfc0", "scanner": "scanner-primary", "fingerprint": "8e782f630a6c9a9d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6bfc78b107d73300", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 backend/harness/opencode/tools/ask_agent.ts:21"}, "properties": {"repobilityId": "2f209de659c3fb0d", "scanner": "scanner-primary", "fingerprint": "6bfc78b107d73300", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-8d447074daca752d", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/verify_ui.py:255"}, "properties": {"repobilityId": "28b54941b4c8fffa", "scanner": "scanner-primary", "fingerprint": "8d447074daca752d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4287c4fd5e7e02a3", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/verify_ui.py:223"}, "properties": {"repobilityId": "7a53f6ffec9034bc", "scanner": "scanner-primary", "fingerprint": "4287c4fd5e7e02a3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-4c303d36b90d33a9", "level": "note", "message": {"text": "Stub function `log_message` (body is just `pass`/`return`) \u2014 specs/opencode-smoke/stub.py:24"}, "properties": {"repobilityId": "cf3490408b78e397", "scanner": "scanner-primary", "fingerprint": "4c303d36b90d33a9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-f59ec02eedc7f29a", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/src/lib/api.ts:48"}, "properties": {"repobilityId": "a3bed99954d32212", "scanner": "scanner-primary", "fingerprint": "f59ec02eedc7f29a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-dd1844e538ed846f", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/canvas/Canvas.tsx:42"}, "properties": {"repobilityId": "c6e577b529a2fcfb", "scanner": "scanner-primary", "fingerprint": "dd1844e538ed846f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-04af76dcf4a45fdb", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/canvas/graphMapping.ts:1"}, "properties": {"repobilityId": "e5da27d52d666f6d", "scanner": "scanner-primary", "fingerprint": "04af76dcf4a45fdb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-18c4c424fa373a41", "level": "none", "message": {"text": "Commented-code block (12 lines) in frontend/src/canvas/FloatingEdge.tsx:3"}, "properties": {"repobilityId": "33dd7aaffc8b8759", "scanner": "scanner-primary", "fingerprint": "18c4c424fa373a41", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "50777c86335ee73a", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "9bc662644bddbf69", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "083f9b31c0e7392d", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "7e0d557ba9fcef83", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-d0b9806a09cf7fc8", "level": "error", "message": {"text": "FastAPI POST `answer_question` without auth dependency \u2014 backend/api/questions.py:19"}, "properties": {"repobilityId": "b8a324d93189da36", "scanner": "scanner-primary", "fingerprint": "d0b9806a09cf7fc8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/api/questions.py"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-53ae1be32b76f1ab", "level": "error", "message": {"text": "FastAPI POST `create_task` without auth dependency \u2014 backend/api/tasks.py:27"}, "properties": {"repobilityId": "8475ed6081cbd12c", "scanner": "scanner-primary", "fingerprint": "53ae1be32b76f1ab", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/api/tasks.py"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-53b1d612c163eaf2", "level": "error", "message": {"text": "FastAPI POST `retry_task` without auth dependency \u2014 backend/api/tasks.py:50"}, "properties": {"repobilityId": "1df7d41987bb5c7e", "scanner": "scanner-primary", "fingerprint": "53b1d612c163eaf2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/api/tasks.py"}, "region": {"startLine": 50}}}]}, {"ruleId": "scanner-8d63281bcd2af3b0", "level": "error", "message": {"text": "FastAPI POST `create_team` without auth dependency \u2014 backend/api/teams.py:18"}, "properties": {"repobilityId": "d29f8d0bf9df7a31", "scanner": "scanner-primary", "fingerprint": "8d63281bcd2af3b0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/api/teams.py"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-bcef616ab71f62ec", "level": "error", "message": {"text": "FastAPI PUT `put_team_graph` without auth dependency \u2014 backend/api/teams.py:42"}, "properties": {"repobilityId": "ad13c59e814ba04a", "scanner": "scanner-primary", "fingerprint": "bcef616ab71f62ec", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/api/teams.py"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-67721d7094fcad8e", "level": "error", "message": {"text": "FastAPI POST `rename_team` without auth dependency \u2014 backend/api/teams.py:46"}, "properties": {"repobilityId": "f7cc14b2d5bcbef0", "scanner": "scanner-primary", "fingerprint": "67721d7094fcad8e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/api/teams.py"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-d34b455df2714af3", "level": "error", "message": {"text": "FastAPI POST `launch_session` without auth dependency \u2014 backend/api/sessions.py:22"}, "properties": {"repobilityId": "abb12d0ce2747d7f", "scanner": "scanner-primary", "fingerprint": "d34b455df2714af3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/api/sessions.py"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-c10ec43d2a88a9f6", "level": "error", "message": {"text": "FastAPI POST `resume_session` without auth dependency \u2014 backend/api/sessions.py:43"}, "properties": {"repobilityId": "8029793e82de4d2c", "scanner": "scanner-primary", "fingerprint": "c10ec43d2a88a9f6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/api/sessions.py"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-047ddc9576e6aadd", "level": "error", "message": {"text": "FastAPI POST `set_mode` without auth dependency \u2014 backend/api/sessions.py:64"}, "properties": {"repobilityId": "98a8aab782a9b3f3", "scanner": "scanner-primary", "fingerprint": "047ddc9576e6aadd", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/api/sessions.py"}, "region": {"startLine": 64}}}]}, {"ruleId": "scanner-c239ed0f05b545fa", "level": "error", "message": {"text": "FastAPI POST `install` without auth dependency \u2014 backend/api/internal.py:23"}, "properties": {"repobilityId": "a304f5015d226564", "scanner": "scanner-primary", "fingerprint": "c239ed0f05b545fa", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/api/internal.py"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-e2a402d5e187e07c", "level": "error", "message": {"text": "FastAPI POST `run_agent` without auth dependency \u2014 backend/api/agents.py:20"}, "properties": {"repobilityId": "774a76feb340f8e0", "scanner": "scanner-primary", "fingerprint": "e2a402d5e187e07c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/api/agents.py"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-c60fa7c1ca18718a", "level": "error", "message": {"text": "FastAPI POST `interject_agent` without auth dependency \u2014 backend/api/agents.py:28"}, "properties": {"repobilityId": "bb4e8dd2fd7517bb", "scanner": "scanner-primary", "fingerprint": "c60fa7c1ca18718a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/api/agents.py"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-162ac4ad17efd460", "level": "error", "message": {"text": "FastAPI POST `clear_agent_history` without auth dependency \u2014 backend/api/agents.py:49"}, "properties": {"repobilityId": "3c8df6c54a083ea2", "scanner": "scanner-primary", "fingerprint": "162ac4ad17efd460", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/api/agents.py"}, "region": {"startLine": 49}}}]}, {"ruleId": "scanner-d00bb7ebe21fce09", "level": "error", "message": {"text": "FastAPI POST `summarize_agent_history` without auth dependency \u2014 backend/api/agents.py:59"}, "properties": {"repobilityId": "2c852325401a818d", "scanner": "scanner-primary", "fingerprint": "d00bb7ebe21fce09", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/api/agents.py"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-241cb49af252eaec", "level": "error", "message": {"text": "FastAPI POST `stop_agent` without auth dependency \u2014 backend/api/agents.py:73"}, "properties": {"repobilityId": "b5f497db1d26cc4e", "scanner": "scanner-primary", "fingerprint": "241cb49af252eaec", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/api/agents.py"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-cbbd1702e014928c", "level": "note", "message": {"text": "Unused endpoint: GET /api/questions"}, "properties": {"repobilityId": "cc160fbd6c9ebec5", "scanner": "scanner-primary", "fingerprint": "cbbd1702e014928c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f90ccb675c5f41ed", "level": "note", "message": {"text": "Unused endpoint: POST /api/questions/{question_id}/answer"}, "properties": {"repobilityId": "a6d6ce11068130e7", "scanner": "scanner-primary", "fingerprint": "f90ccb675c5f41ed", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cf16ae0930dc161a", "level": "note", "message": {"text": "Unused endpoint: GET /api/tasks"}, "properties": {"repobilityId": "6f9a0940a1f8aa0b", "scanner": "scanner-primary", "fingerprint": "cf16ae0930dc161a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-dd377e6beb63fde7", "level": "note", "message": {"text": "Unused endpoint: POST /api/tasks"}, "properties": {"repobilityId": "c3712ab966421327", "scanner": "scanner-primary", "fingerprint": "dd377e6beb63fde7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-574e0277428b2c6c", "level": "note", "message": {"text": "Unused endpoint: GET /api/tasks/{task_id}"}, "properties": {"repobilityId": "1f9687e6d5d803ca", "scanner": "scanner-primary", "fingerprint": "574e0277428b2c6c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0161de3ddcf05f6f", "level": "note", "message": {"text": "Unused endpoint: GET /api/teams/{team_id}"}, "properties": {"repobilityId": "6f4f04dbc5a94aed", "scanner": "scanner-primary", "fingerprint": "0161de3ddcf05f6f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7f42d347d0de67e8", "level": "note", "message": {"text": "Unused endpoint: POST /api/teams/{team_id}/rename"}, "properties": {"repobilityId": "ab4bff0c5d7749f3", "scanner": "scanner-primary", "fingerprint": "7f42d347d0de67e8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6b0e7f5976711316", "level": "note", "message": {"text": "Unused endpoint: GET /api/session"}, "properties": {"repobilityId": "f02c6b5888a391e1", "scanner": "scanner-primary", "fingerprint": "6b0e7f5976711316", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2e138a878848dcf7", "level": "note", "message": {"text": "Unused endpoint: POST /api/sessions/{session_id}/resume"}, "properties": {"repobilityId": "10244d96562b3b3f", "scanner": "scanner-primary", "fingerprint": "2e138a878848dcf7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7ece0a6f15c3e51c", "level": "note", "message": {"text": "Unused endpoint: POST /api/session/mode"}, "properties": {"repobilityId": "4a4287cfb43f940d", "scanner": "scanner-primary", "fingerprint": "7ece0a6f15c3e51c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fa65a91e1f52822d", "level": "note", "message": {"text": "Unused endpoint: GET /api/stats/usage/{agent_id}"}, "properties": {"repobilityId": "488d9a62c40aaf27", "scanner": "scanner-primary", "fingerprint": "fa65a91e1f52822d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-45ec9bddac3b08b5", "level": "note", "message": {"text": "Unused endpoint: POST /internal/ask_agent"}, "properties": {"repobilityId": "7d2cf7be1dcc985d", "scanner": "scanner-primary", "fingerprint": "45ec9bddac3b08b5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-43269e4e79c2e69e", "level": "note", "message": {"text": "Unused endpoint: GET /events"}, "properties": {"repobilityId": "9288f2ad19b92f03", "scanner": "scanner-primary", "fingerprint": "43269e4e79c2e69e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d6ab117b48f63059", "level": "note", "message": {"text": "Unused endpoint: POST /api/agent/{agent_id}/run"}, "properties": {"repobilityId": "0dbdfb605d80badd", "scanner": "scanner-primary", "fingerprint": "d6ab117b48f63059", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ba8c716ecdd87091", "level": "note", "message": {"text": "Unused endpoint: POST /api/agent/{agent_id}/interject"}, "properties": {"repobilityId": "62ea33b573979534", "scanner": "scanner-primary", "fingerprint": "ba8c716ecdd87091", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-941b59e1b5a8c068", "level": "note", "message": {"text": "Unused endpoint: GET /api/agent/{agent_id}/history"}, "properties": {"repobilityId": "01726a44f2d0d4c8", "scanner": "scanner-primary", "fingerprint": "941b59e1b5a8c068", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-14c195c86849eaa5", "level": "note", "message": {"text": "Unused endpoint: POST /api/agent/{agent_id}/history/clear"}, "properties": {"repobilityId": "4f902bb1a5a1aed6", "scanner": "scanner-primary", "fingerprint": "14c195c86849eaa5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e84a79aa8abe0fa8", "level": "note", "message": {"text": "Unused endpoint: POST /api/agent/{agent_id}/history/summarize"}, "properties": {"repobilityId": "2fda30e38be82ace", "scanner": "scanner-primary", "fingerprint": "e84a79aa8abe0fa8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6e7cc6e6c338492c", "level": "note", "message": {"text": "Unused endpoint: POST /api/agent/{agent_id}/stop"}, "properties": {"repobilityId": "c1fb97c73d2a89e2", "scanner": "scanner-primary", "fingerprint": "6e7cc6e6c338492c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-205e269e06ed0d72", "level": "note", "message": {"text": "Unused endpoint: GET /api/messages"}, "properties": {"repobilityId": "ba589a6086968a4b", "scanner": "scanner-primary", "fingerprint": "205e269e06ed0d72", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}