{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-1939e6bf5c3562ad", "name": "Possibly dead Python function: work", "shortDescription": {"text": "Possibly dead Python function: work"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-efb1618003a4f281", "name": "Possibly dead Python function: work", "shortDescription": {"text": "Possibly dead Python function: work"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1927b1cd8cfb0f99", "name": "Possibly dead Python function: work", "shortDescription": {"text": "Possibly dead Python function: work"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6cb05a2e30fb2bde", "name": "Possibly dead Python function: backfill_skill_version", "shortDescription": {"text": "Possibly dead Python function: backfill_skill_version"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9c4381a5f7ecdb10", "name": "Possibly dead Python function: automated_licence_review", "shortDescription": {"text": "Possibly dead Python function: automated_licence_review"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-def8d7976cc0e911", "name": "Possibly dead Python function: populate_legal_edges", "shortDescription": {"text": "Possibly dead Python function: populate_legal_edges"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-50439ab1c5abb1a2", "name": "Possibly dead Python function: seed_golden_fixture", "shortDescription": {"text": "Possibly dead Python function: seed_golden_fixture"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f2c6c959c15166f0", "name": "Possibly dead Python function: db_state", "shortDescription": {"text": "Possibly dead Python function: db_state"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6b5151ff51c90c87", "name": "Possibly dead Python function: work", "shortDescription": {"text": "Possibly dead Python function: work"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f7e37936ec279e91", "name": "Possibly dead Python function: build_model_adapter", "shortDescription": {"text": "Possibly dead Python function: build_model_adapter"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-190c3852fde8679b", "name": "Possibly dead Python function: require_allowed_origin", "shortDescription": {"text": "Possibly dead Python function: require_allowed_origin"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f52ffeb46fd5792c", "name": "Possibly dead Python function: dep", "shortDescription": {"text": "Possibly dead Python function: dep"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4474fb098b5ee3ea", "name": "Possibly dead Python function: record", "shortDescription": {"text": "Possibly dead Python function: record"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6b91ce98c1ee8a09", "name": "Possibly dead Python function: stop", "shortDescription": {"text": "Possibly dead Python function: stop"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-573ddfdd92637dac", "name": "Possibly dead Python function: decorate", "shortDescription": {"text": "Possibly dead Python function: decorate"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a3d36fdb7e6307a5", "name": "Possibly dead Python function: embed_chunk", "shortDescription": {"text": "Possibly dead Python function: embed_chunk"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bb5efe80bde32bce", "name": "Possibly dead Python function: generate_source_chunk_embeddings", "shortDescription": {"text": "Possibly dead Python function: generate_source_chunk_embeddings"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b8145f3a7d4f26e0", "name": "Possibly dead Python function: import_gnaf_wa", "shortDescription": {"text": "Possibly dead Python function: import_gnaf_wa"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8354817630d132b9", "name": "Possibly dead Python function: run_validators", "shortDescription": {"text": "Possibly dead Python function: run_validators"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4271300b53cfbdfe", "name": "Possibly dead Python function: eval_gate_pass", "shortDescription": {"text": "Possibly dead Python function: eval_gate_pass"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-860abbd35c4836a8", "name": "Possibly dead Python function: auto_promote", "shortDescription": {"text": "Possibly dead Python function: auto_promote"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8e0dbe9977e64055", "name": "Possibly dead Python function: classify_clause", "shortDescription": {"text": "Possibly dead Python function: classify_clause"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9f4a8988fb979843", "name": "Possibly dead Python function: enqueue_extraction_group", "shortDescription": {"text": "Possibly dead Python function: enqueue_extraction_group"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b213050d4f10bf87", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 web/src/views/home.tsx:362", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 web/src/views/home.tsx:362"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-007fe80aa084272d", "name": "Privileged port 587 in use", "shortDescription": {"text": "Privileged port 587 in use"}, "fullDescription": {"text": "Port 587 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1f5a866133e40744", "name": "Dockerfile runs as root: infra/v3/db/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: infra/v3/db/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-43be33030bf67185", "name": "Docker base image is tag-pinned but not digest-pinned: postgis/postgis:16-3.5", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: postgis/postgis:16-3.5"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-efc4bde65ee7291d", "name": "Insecure pattern 'node_child_process' in web/scripts/test-live-launch-preview.mjs:4", "shortDescription": {"text": "Insecure pattern 'node_child_process' in web/scripts/test-live-launch-preview.mjs:4"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e864697c2740398a", "name": "Insecure pattern 'direct_innerhtml_assignment' in web/src/App.launch.test.tsx:23", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web/src/App.launch.test.tsx:23"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9aba89b8f120420b", "name": "Insecure pattern 'dangerous_innerhtml' in web/src/views/home.tsx:362", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in web/src/views/home.tsx:362"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b81c527268a01bd9", "name": "Very large file: src/draftcheck/db/models.py (2227 lines)", "shortDescription": {"text": "Very large file: src/draftcheck/db/models.py (2227 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5125915fe9ae99fe", "name": "Very large file: src/draftcheck/domain/documents/parsing.py (2261 lines)", "shortDescription": {"text": "Very large file: src/draftcheck/domain/documents/parsing.py (2261 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 115 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 34 placeholder/mock markers across 16 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e725d2ab884fbd49", "name": "Multiple root agent instruction files without precedence", "shortDescription": {"text": "Multiple root agent instruction files without precedence"}, "fullDescription": {"text": "The repo has multiple top-level AI-coder instruction files. Without precedence rules, different agents may follow different policies."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e2953c1e57a23ce5", "name": "Legacy-named symbol `doc_legacy` in tests/test_document_parser_registry.py:33", "shortDescription": {"text": "Legacy-named symbol `doc_legacy` in tests/test_document_parser_registry.py:33"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c8f83dcea5454654", "name": "Legacy-named symbol `test_v3_health_and_ready_are_mounted_only_under_api_v1` in tests/test_v3_api_shell.py:18", "shortDescription": {"text": "Legacy-named symbol `test_v3_health_and_ready_are_mounted_only_under_api_v1` in tests/test_v3_api_shell.py:18"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eb58833c02a996db", "name": "Legacy-named symbol `parser_real_sample_evidence_v1` in tests/test_v3_documents.py:64", "shortDescription": {"text": "Legacy-named symbol `parser_real_sample_evidence_v1` in tests/test_v3_documents.py:64"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e621770c453c37b5", "name": "Legacy-named symbol `parser_real_sample_evidence_v1` in tests/test_parser_sample_evidence.py:39", "shortDescription": {"text": "Legacy-named symbol `parser_real_sample_evidence_v1` in tests/test_parser_sample_evidence.py:39"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-63eee193814966ca", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/precommit_guard.py:52", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/precommit_guard.py:52"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f63acfa3206ee7fd", "name": "Legacy-named symbol `wp6_open_adversarial_review_v1` in scripts/wp6_apply_open_review.py:23", "shortDescription": {"text": "Legacy-named symbol `wp6_open_adversarial_review_v1` in scripts/wp6_apply_open_review.py:23"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c40ccd97e9c64ede", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/wp2_spatial_load.py:38", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/wp2_spatial_load.py:38"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-86ad7bcf9fbe3691", "name": "Legacy-named symbol `wp6_sonnet_v1` in scripts/wp6_sonnet_postprocess.py:39", "shortDescription": {"text": "Legacy-named symbol `wp6_sonnet_v1` in scripts/wp6_sonnet_postprocess.py:39"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-76aaa79bc9c5b143", "name": "Legacy-named symbol `wp6_lot_area_operator_curation_v1` in scripts/wp6_curate_lot_area_operators.py:46", "shortDescription": {"text": "Legacy-named symbol `wp6_lot_area_operator_curation_v1` in scripts/wp6_curate_lot_area_operators.py:46"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8dae32b295053a0c", "name": "Legacy-named symbol `wp6_adjudicate_v2` in scripts/wp6_adjudicate.py:168", "shortDescription": {"text": "Legacy-named symbol `wp6_adjudicate_v2` in scripts/wp6_adjudicate.py:168"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fa8ca5f56c037d09", "name": "Legacy-named symbol `wp6_sonnet_v1` in scripts/wp6_solo_promote.py:48", "shortDescription": {"text": "Legacy-named symbol `wp6_sonnet_v1` in scripts/wp6_solo_promote.py:48"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-45da7057b7377cbd", "name": "Commented-code block (5 lines) in scripts/wp6_solo_promote.py:118", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/wp6_solo_promote.py:118"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f43af9e902356290", "name": "Commented-code block (5 lines) in scripts/wp6_cluster_keys.py:62", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/wp6_cluster_keys.py:62"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-39e1cee6dcc5a7e8", "name": "Legacy-named symbol `wp6_apply_adv_review_v1` in scripts/wp6_apply_adv_review.py:198", "shortDescription": {"text": "Legacy-named symbol `wp6_apply_adv_review_v1` in scripts/wp6_apply_adv_review.py:198"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d60d1de1fb589906", "name": "Legacy-named symbol `parser_real_sample_evidence_v1` in scripts/parser_sample_evidence.py:20", "shortDescription": {"text": "Legacy-named symbol `parser_real_sample_evidence_v1` in scripts/parser_sample_evidence.py:20"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4d5ff67c7f666d0f", "name": "Legacy-named symbol `lotfile_guest_usage_v1` in web/src/config.ts:3", "shortDescription": {"text": "Legacy-named symbol `lotfile_guest_usage_v1` in web/src/config.ts:3"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-79beb5b46f4b514f", "name": "Commented-code block (5 lines) in src/draftcheck/governance/validators/check_results.py:158", "shortDescription": {"text": "Commented-code block (5 lines) in src/draftcheck/governance/validators/check_results.py:158"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7f9e667d25b6f0b7", "name": "Commented-code block (7 lines) in src/draftcheck/governance/validators/pipeline_steps.py:36", "shortDescription": {"text": "Commented-code block (7 lines) in src/draftcheck/governance/validators/pipeline_steps.py:36"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0872e6237ac53c59", "name": "Commented-code block (5 lines) in src/draftcheck/db/models.py:427", "shortDescription": {"text": "Commented-code block (5 lines) in src/draftcheck/db/models.py:427"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-74de6210585423ae", "name": "Commented-code block (6 lines) in src/draftcheck/checks/registry.py:3", "shortDescription": {"text": "Commented-code block (6 lines) in src/draftcheck/checks/registry.py:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4b9b93b0ad0df4de", "name": "Commented-code block (19 lines) in src/draftcheck/checks/category_map.py:110", "shortDescription": {"text": "Commented-code block (19 lines) in src/draftcheck/checks/category_map.py:110"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-15fbcd9b9e3e76e1", "name": "Commented-code block (6 lines) in src/draftcheck/extraction/vocabulary.py:30", "shortDescription": {"text": "Commented-code block (6 lines) in src/draftcheck/extraction/vocabulary.py:30"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-85cf14394032aa0a", "name": "Commented-code block (6 lines) in src/draftcheck/extraction/adjudication.py:107", "shortDescription": {"text": "Commented-code block (6 lines) in src/draftcheck/extraction/adjudication.py:107"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b19e00a38b80a28a", "name": "Commented-code block (8 lines) in src/draftcheck/domain/address/postgis_store.py:575", "shortDescription": {"text": "Commented-code block (8 lines) in src/draftcheck/domain/address/postgis_store.py:575"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-da0f087e7edefae9", "name": "Commented-code block (5 lines) in src/draftcheck/domain/sources/library.py:741", "shortDescription": {"text": "Commented-code block (5 lines) in src/draftcheck/domain/sources/library.py:741"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5b2466707e5b976c", "name": "Legacy-named symbol `parser_real_sample_evidence_v1` in src/draftcheck/domain/documents/parsing.py:63", "shortDescription": {"text": "Legacy-named symbol `parser_real_sample_evidence_v1` in src/draftcheck/domain/documents/parsing.py:63"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4d223bfdf539b12d", "name": "42 env vars used in code but missing from .env.example", "shortDescription": {"text": "42 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `ANTHROPIC_API_KEY`, `APP_ENV`, `AUTH_TOKEN_HASH_PEPPER`, `CHROME_PATH`, `DRAFTCHECK_ASSISTANT_MAX_CONTEXT_CHUNKS`, `DRAFTCHECK_ASSISTANT_MIN_SCORE`, `DRAFTCHECK_ASSISTANT_RELATIVE_FLOOR`, `DRAFTCHECK_AUTH_STORE` + 34 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nscripts/wp6_decode.py:openai_decode, scripts/wp6_redecode.py:openai_decode\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-02525d39071dd2c7", "name": "Near-duplicate function bodies in 5 places", "shortDescription": {"text": "Near-duplicate function bodies in 5 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nscripts/wp6_decode.py:db_url, scripts/wp6_correct.py:db_url, scripts/wp6_review.py:db_url, scripts/wp6_promote_decode.py:db_url\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nsrc/draftcheck/ai/substrate.py:complete, src/draftcheck/ai/substrate.py:complete, src/draftcheck/ai/substrate.py:complete\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6f33079af17445b8", "name": "FastAPI POST `request_magic_link` without auth dependency \u2014 src/draftcheck/api/auth.py:191", "shortDescription": {"text": "FastAPI POST `request_magic_link` without auth dependency \u2014 src/draftcheck/api/auth.py:191"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3912ac1def37c69b", "name": "FastAPI POST `verify_magic_link` without auth dependency \u2014 src/draftcheck/api/auth.py:207", "shortDescription": {"text": "FastAPI POST `verify_magic_link` without auth dependency \u2014 src/draftcheck/api/auth.py:207"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a02c4ca64dab6094", "name": "FastAPI POST `dev_login` without auth dependency \u2014 src/draftcheck/api/auth.py:218", "shortDescription": {"text": "FastAPI POST `dev_login` without auth dependency \u2014 src/draftcheck/api/auth.py:218"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4c71d14ab08b7b2b", "name": "FastAPI POST `guest_login` without auth dependency \u2014 src/draftcheck/api/auth.py:278", "shortDescription": {"text": "FastAPI POST `guest_login` without auth dependency \u2014 src/draftcheck/api/auth.py:278"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5271189ba09f6085", "name": "FastAPI POST `promote_rule_candidate` without auth dependency \u2014 src/draftcheck/api/v1.py:252", "shortDescription": {"text": "FastAPI POST `promote_rule_candidate` without auth dependency \u2014 src/draftcheck/api/v1.py:252"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-62fce67bf05b1aad", "name": "FastAPI POST `reject_rule_candidate` without auth dependency \u2014 src/draftcheck/api/v1.py:257", "shortDescription": {"text": "FastAPI POST `reject_rule_candidate` without auth dependency \u2014 src/draftcheck/api/v1.py:257"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f7b52d9d4ce9dc28", "name": "FastAPI POST `review_rule` without auth dependency \u2014 src/draftcheck/api/v1.py:267", "shortDescription": {"text": "FastAPI POST `review_rule` without auth dependency \u2014 src/draftcheck/api/v1.py:267"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-26d65d90e038368b", "name": "FastAPI POST `parse_project_rfi` without auth dependency \u2014 src/draftcheck/api/v1.py:278", "shortDescription": {"text": "FastAPI POST `parse_project_rfi` without auth dependency \u2014 src/draftcheck/api/v1.py:278"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4f902f0d1f4a1334", "name": "FastAPI POST `draft_rfi_response` without auth dependency \u2014 src/draftcheck/api/v1.py:288", "shortDescription": {"text": "FastAPI POST `draft_rfi_response` without auth dependency \u2014 src/draftcheck/api/v1.py:288"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d64160d55a47a1e1", "name": "FastAPI POST `create_export` without auth dependency \u2014 src/draftcheck/api/v1.py:298", "shortDescription": {"text": "FastAPI POST `create_export` without auth dependency \u2014 src/draftcheck/api/v1.py:298"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5758c57d5de0aa55", "name": "FastAPI POST `resolve_review` without auth dependency \u2014 src/draftcheck/api/v1.py:318", "shortDescription": {"text": "FastAPI POST `resolve_review` without auth dependency \u2014 src/draftcheck/api/v1.py:318"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3b75ec67bc8f12c4", "name": "FastAPI POST `retry_agent_job` without auth dependency \u2014 src/draftcheck/api/v1.py:328", "shortDescription": {"text": "FastAPI POST `retry_agent_job` without auth dependency \u2014 src/draftcheck/api/v1.py:328"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c33bd5cdd60946ae", "name": "FastAPI POST `cancel_agent_job` without auth dependency \u2014 src/draftcheck/api/v1.py:333", "shortDescription": {"text": "FastAPI POST `cancel_agent_job` without auth dependency \u2014 src/draftcheck/api/v1.py:333"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-63ffda473a804f17", "name": "FastAPI PUT `update_agent_memory` without auth dependency \u2014 src/draftcheck/api/v1.py:348", "shortDescription": {"text": "FastAPI PUT `update_agent_memory` without auth dependency \u2014 src/draftcheck/api/v1.py:348"}, "fullDescription": {"text": "`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-577181738d48622b", "name": "FastAPI POST `activate_agent_skill` without auth dependency \u2014 src/draftcheck/api/v1.py:363", "shortDescription": {"text": "FastAPI POST `activate_agent_skill` without auth dependency \u2014 src/draftcheck/api/v1.py:363"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c46e44facb67bedb", "name": "FastAPI POST `run_agent_evals` without auth dependency \u2014 src/draftcheck/api/v1.py:373", "shortDescription": {"text": "FastAPI POST `run_agent_evals` without auth dependency \u2014 src/draftcheck/api/v1.py:373"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7a009b1a56794f45", "name": "Unused endpoint: POST /", "shortDescription": {"text": "Unused endpoint: POST /"}, "fullDescription": {"text": "`src/draftcheck/api/projects.py` declares `POST /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`src/draftcheck/api/projects.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-106f3e7fc5f65e4f", "name": "Unused endpoint: GET /{project_id}", "shortDescription": {"text": "Unused endpoint: GET /{project_id}"}, "fullDescription": {"text": "`src/draftcheck/api/projects.py` declares `GET /{project_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-75726e5afbeebf0b", "name": "Unused endpoint: PATCH /{project_id}", "shortDescription": {"text": "Unused endpoint: PATCH /{project_id}"}, "fullDescription": {"text": "`src/draftcheck/api/projects.py` declares `PATCH /{project_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b9174fa868399f10", "name": "Unused endpoint: DELETE /{project_id}", "shortDescription": {"text": "Unused endpoint: DELETE /{project_id}"}, "fullDescription": {"text": "`src/draftcheck/api/projects.py` declares `DELETE /{project_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b2dc119a7130e939", "name": "Unused endpoint: POST /{project_id}/property/override", "shortDescription": {"text": "Unused endpoint: POST /{project_id}/property/override"}, "fullDescription": {"text": "`src/draftcheck/api/projects.py` declares `POST /{project_id}/property/override` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d91aaa81332f9fd", "name": "Unused endpoint: POST /{project_id}/proposal", "shortDescription": {"text": "Unused endpoint: POST /{project_id}/proposal"}, "fullDescription": {"text": "`src/draftcheck/api/projects.py` declares `POST /{project_id}/proposal` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea36ea6caf451096", "name": "Unused endpoint: GET /address/search", "shortDescription": {"text": "Unused endpoint: GET /address/search"}, "fullDescription": {"text": "`src/draftcheck/api/address.py` declares `GET /address/search` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e02fa36c309f294b", "name": "Unused endpoint: POST /projects/{project_id}/resolve-address", "shortDescription": {"text": "Unused endpoint: POST /projects/{project_id}/resolve-address"}, "fullDescription": {"text": "`src/draftcheck/api/address.py` declares `POST /projects/{project_id}/resolve-address` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6980ca314959e417", "name": "Unused endpoint: GET /projects/{project_id}/property", "shortDescription": {"text": "Unused endpoint: GET /projects/{project_id}/property"}, "fullDescription": {"text": "`src/draftcheck/api/address.py` declares `GET /projects/{project_id}/property` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e02f8c59b8ded7ec", "name": "Unused endpoint: POST /auth/magic-link/request", "shortDescription": {"text": "Unused endpoint: POST /auth/magic-link/request"}, "fullDescription": {"text": "`src/draftcheck/api/auth.py` declares `POST /auth/magic-link/request` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4fb2564af590f75f", "name": "Unused endpoint: POST /auth/magic-link/verify", "shortDescription": {"text": "Unused endpoint: POST /auth/magic-link/verify"}, "fullDescription": {"text": "`src/draftcheck/api/auth.py` declares `POST /auth/magic-link/verify` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b2d21770371f71a3", "name": "Unused endpoint: POST /auth/dev-login", "shortDescription": {"text": "Unused endpoint: POST /auth/dev-login"}, "fullDescription": {"text": "`src/draftcheck/api/auth.py` declares `POST /auth/dev-login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-003a8b005c19bfda", "name": "Unused endpoint: POST /auth/guest", "shortDescription": {"text": "Unused endpoint: POST /auth/guest"}, "fullDescription": {"text": "`src/draftcheck/api/auth.py` declares `POST /auth/guest` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b09fff413cd9f079", "name": "Unused endpoint: GET /auth/session", "shortDescription": {"text": "Unused endpoint: GET /auth/session"}, "fullDescription": {"text": "`src/draftcheck/api/auth.py` declares `GET /auth/session` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c059f57186114027", "name": "Unused endpoint: POST /auth/logout", "shortDescription": {"text": "Unused endpoint: POST /auth/logout"}, "fullDescription": {"text": "`src/draftcheck/api/auth.py` declares `POST /auth/logout` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-522aca098fa53cf1", "name": "Unused endpoint: POST /projects/{project_id}/run", "shortDescription": {"text": "Unused endpoint: POST /projects/{project_id}/run"}, "fullDescription": {"text": "`src/draftcheck/api/compliance.py` declares `POST /projects/{project_id}/run` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-005db54230e76841", "name": "Unused endpoint: GET /projects/{project_id}/matrix", "shortDescription": {"text": "Unused endpoint: GET /projects/{project_id}/matrix"}, "fullDescription": {"text": "`src/draftcheck/api/compliance.py` declares `GET /projects/{project_id}/matrix` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f765590c3fd49099", "name": "Unused endpoint: POST /results/{result_id}/override", "shortDescription": {"text": "Unused endpoint: POST /results/{result_id}/override"}, "fullDescription": {"text": "`src/draftcheck/api/compliance.py` declares `POST /results/{result_id}/override` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-55f8c8cf959a5664", "name": "Unused endpoint: GET /runs/{run_id}", "shortDescription": {"text": "Unused endpoint: GET /runs/{run_id}"}, "fullDescription": {"text": "`src/draftcheck/api/compliance.py` declares `GET /runs/{run_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-02d460f9c508cb7a", "name": "Unused endpoint: POST /sources/import", "shortDescription": {"text": "Unused endpoint: POST /sources/import"}, "fullDescription": {"text": "`src/draftcheck/api/sources.py` declares `POST /sources/import` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9617aa24fd377881", "name": "Unused endpoint: GET /sources", "shortDescription": {"text": "Unused endpoint: GET /sources"}, "fullDescription": {"text": "`src/draftcheck/api/sources.py` declares `GET /sources` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-22e6a4dd12cc8751", "name": "Unused endpoint: GET /sources/freshness", "shortDescription": {"text": "Unused endpoint: GET /sources/freshness"}, "fullDescription": {"text": "`src/draftcheck/api/sources.py` declares `GET /sources/freshness` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-31d9e484e08dfe3f", "name": "Unused endpoint: GET /sources/ingestion-status", "shortDescription": {"text": "Unused endpoint: GET /sources/ingestion-status"}, "fullDescription": {"text": "`src/draftcheck/api/sources.py` declares `GET /sources/ingestion-status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-172e07800a837b1b", "name": "Unused endpoint: GET /sources/review-worklist", "shortDescription": {"text": "Unused endpoint: GET /sources/review-worklist"}, "fullDescription": {"text": "`src/draftcheck/api/sources.py` declares `GET /sources/review-worklist` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5128238b944d9319", "name": "Unused endpoint: GET /sources/quality-report", "shortDescription": {"text": "Unused endpoint: GET /sources/quality-report"}, "fullDescription": {"text": "`src/draftcheck/api/sources.py` declares `GET /sources/quality-report` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7dcd188c65e4fb72", "name": "Unused endpoint: GET /sources/{source_id}/versions/{source_version_id}/review-packet", "shortDescription": {"text": "Unused endpoint: GET /sources/{source_id}/versions/{source_version_id}/review-packet"}, "fullDescription": {"text": "`src/draftcheck/api/sources.py` declares `GET /sources/{source_id}/versions/{source_version_id}/review-packet` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6df0cb5c69bfa696", "name": "Unused endpoint: GET /sources/{source_id}", "shortDescription": {"text": "Unused endpoint: GET /sources/{source_id}"}, "fullDescription": {"text": "`src/draftcheck/api/sources.py` declares `GET /sources/{source_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d36019a83393ae10", "name": "Unused endpoint: GET /sources/{source_id}/versions", "shortDescription": {"text": "Unused endpoint: GET /sources/{source_id}/versions"}, "fullDescription": {"text": "`src/draftcheck/api/sources.py` declares `GET /sources/{source_id}/versions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8b92a01e9875887c", "name": "Unused endpoint: POST /sources/{source_id}/review", "shortDescription": {"text": "Unused endpoint: POST /sources/{source_id}/review"}, "fullDescription": {"text": "`src/draftcheck/api/sources.py` declares `POST /sources/{source_id}/review` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b091532b993e22b5", "name": "Unused endpoint: POST /sources/{source_id}/refresh", "shortDescription": {"text": "Unused endpoint: POST /sources/{source_id}/refresh"}, "fullDescription": {"text": "`src/draftcheck/api/sources.py` declares `POST /sources/{source_id}/refresh` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0416e04a84bae50d", "name": "Unused endpoint: POST /search/chunks", "shortDescription": {"text": "Unused endpoint: POST /search/chunks"}, "fullDescription": {"text": "`src/draftcheck/api/sources.py` declares `POST /search/chunks` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-721aeb68154b4b65", "name": "Unused endpoint: POST /search/ask", "shortDescription": {"text": "Unused endpoint: POST /search/ask"}, "fullDescription": {"text": "`src/draftcheck/api/sources.py` declares `POST /search/ask` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f953ff48b9e2933c", "name": "Unused endpoint: POST /assistant", "shortDescription": {"text": "Unused endpoint: POST /assistant"}, "fullDescription": {"text": "`src/draftcheck/api/sources.py` declares `POST /assistant` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ab7ce0fa328c93ea", "name": "Unused endpoint: GET /candidates", "shortDescription": {"text": "Unused endpoint: GET /candidates"}, "fullDescription": {"text": "`src/draftcheck/api/rules.py` declares `GET /candidates` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6d0dcf0565664c66", "name": "Unused endpoint: GET /candidates/{candidate_id}", "shortDescription": {"text": "Unused endpoint: GET /candidates/{candidate_id}"}, "fullDescription": {"text": "`src/draftcheck/api/rules.py` declares `GET /candidates/{candidate_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6be8f9a37fd44a54", "name": "Unused endpoint: POST /candidates/{candidate_id}/review", "shortDescription": {"text": "Unused endpoint: POST /candidates/{candidate_id}/review"}, "fullDescription": {"text": "`src/draftcheck/api/rules.py` declares `POST /candidates/{candidate_id}/review` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1d8da59b2047b102", "name": "Unused endpoint: GET /clauses", "shortDescription": {"text": "Unused endpoint: GET /clauses"}, "fullDescription": {"text": "`src/draftcheck/api/rules.py` declares `GET /clauses` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8edb4fe434de6f50", "name": "Unused endpoint: GET /clauses/{clause_id}", "shortDescription": {"text": "Unused endpoint: GET /clauses/{clause_id}"}, "fullDescription": {"text": "`src/draftcheck/api/rules.py` declares `GET /clauses/{clause_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0c948ea72b525d34", "name": "Unused endpoint: GET /{rule_id}", "shortDescription": {"text": "Unused endpoint: GET /{rule_id}"}, "fullDescription": {"text": "`src/draftcheck/api/rules.py` declares `GET /{rule_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-89850765108ae647", "name": "Unused endpoint: POST /{rule_id}/review", "shortDescription": {"text": "Unused endpoint: POST /{rule_id}/review"}, "fullDescription": {"text": "`src/draftcheck/api/rules.py` declares `POST /{rule_id}/review` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-44aa02cbf0168dbf", "name": "Unused endpoint: POST /{rule_id}/approve", "shortDescription": {"text": "Unused endpoint: POST /{rule_id}/approve"}, "fullDescription": {"text": "`src/draftcheck/api/rules.py` declares `POST /{rule_id}/approve` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ef629ad75f4cc3f0", "name": "Unused endpoint: GET /documents/parsers", "shortDescription": {"text": "Unused endpoint: GET /documents/parsers"}, "fullDescription": {"text": "`src/draftcheck/api/documents.py` declares `GET /documents/parsers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c0d17a25c6cb4bc1", "name": "Unused endpoint: GET /documents/parsers/accuracy", "shortDescription": {"text": "Unused endpoint: GET /documents/parsers/accuracy"}, "fullDescription": {"text": "`src/draftcheck/api/documents.py` declares `GET /documents/parsers/accuracy` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b1c8fc58a4e17836", "name": "Unused endpoint: POST /documents/upload", "shortDescription": {"text": "Unused endpoint: POST /documents/upload"}, "fullDescription": {"text": "`src/draftcheck/api/documents.py` declares `POST /documents/upload` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c0212e3558db7bc1", "name": "Unused endpoint: PATCH /documents/{doc_id}/facts/{fact_id}", "shortDescription": {"text": "Unused endpoint: PATCH /documents/{doc_id}/facts/{fact_id}"}, "fullDescription": {"text": "`src/draftcheck/api/documents.py` declares `PATCH /documents/{doc_id}/facts/{fact_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d1f1b5c9c9e165e5", "name": "Unused endpoint: POST /documents/{doc_id}/facts/{fact_id}/promote", "shortDescription": {"text": "Unused endpoint: POST /documents/{doc_id}/facts/{fact_id}/promote"}, "fullDescription": {"text": "`src/draftcheck/api/documents.py` declares `POST /documents/{doc_id}/facts/{fact_id}/promote` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0b9dc27a48a47631", "name": "Unused endpoint: GET /documents/{document_id}/persisted-facts", "shortDescription": {"text": "Unused endpoint: GET /documents/{document_id}/persisted-facts"}, "fullDescription": {"text": "`src/draftcheck/api/documents.py` declares `GET /documents/{document_id}/persisted-facts` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-23e7560d68629300", "name": "Unused endpoint: GET /documents/projects/{project_id}/evidence-search", "shortDescription": {"text": "Unused endpoint: GET /documents/projects/{project_id}/evidence-search"}, "fullDescription": {"text": "`src/draftcheck/api/documents.py` declares `GET /documents/projects/{project_id}/evidence-search` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a255586169af3e81", "name": "Unused endpoint: POST /documents/projects/{project_id}/upload", "shortDescription": {"text": "Unused endpoint: POST /documents/projects/{project_id}/upload"}, "fullDescription": {"text": "`src/draftcheck/api/documents.py` declares `POST /documents/projects/{project_id}/upload` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/20330"}, "properties": {"repository": "stevenshelley58-afk/cuz.fail", "repoUrl": "https://github.com/stevenshelley58-afk/cuz.fail", "branch": "main"}, "results": [{"ruleId": "scanner-1939e6bf5c3562ad", "level": "note", "message": {"text": "Possibly dead Python function: work"}, "properties": {"repobilityId": "c5b0e9acf413d08f", "scanner": "scanner-primary", "fingerprint": "1939e6bf5c3562ad", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/wp6_decode.py:278"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-efb1618003a4f281", "level": "note", "message": {"text": "Possibly dead Python function: work"}, "properties": {"repobilityId": "c5b0e9acf413d08f", "scanner": "scanner-primary", "fingerprint": "efb1618003a4f281", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/wp6_extract.py:1010"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1927b1cd8cfb0f99", "level": "note", "message": {"text": "Possibly dead Python function: work"}, "properties": {"repobilityId": "c5b0e9acf413d08f", "scanner": "scanner-primary", "fingerprint": "1927b1cd8cfb0f99", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/wp6_correct.py:206"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6cb05a2e30fb2bde", "level": "note", "message": {"text": "Possibly dead Python function: backfill_skill_version"}, "properties": {"repobilityId": "2de78dce3cf04c33", "scanner": "scanner-primary", "fingerprint": "6cb05a2e30fb2bde", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/wp9_complete_db.py:75"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9c4381a5f7ecdb10", "level": "note", "message": {"text": "Possibly dead Python function: automated_licence_review"}, "properties": {"repobilityId": "842426f4474e2a55", "scanner": "scanner-primary", "fingerprint": "9c4381a5f7ecdb10", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/wp9_complete_db.py:112"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-def8d7976cc0e911", "level": "note", "message": {"text": "Possibly dead Python function: populate_legal_edges"}, "properties": {"repobilityId": "e7549d3183000d6b", "scanner": "scanner-primary", "fingerprint": "def8d7976cc0e911", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/wp9_complete_db.py:161"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-50439ab1c5abb1a2", "level": "note", "message": {"text": "Possibly dead Python function: seed_golden_fixture"}, "properties": {"repobilityId": "8d411655054e5b7e", "scanner": "scanner-primary", "fingerprint": "50439ab1c5abb1a2", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/wp9_complete_db.py:244"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f2c6c959c15166f0", "level": "note", "message": {"text": "Possibly dead Python function: db_state"}, "properties": {"repobilityId": "abe2a58be40cd4fa", "scanner": "scanner-primary", "fingerprint": "f2c6c959c15166f0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/wp9_complete_db.py:329"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6b5151ff51c90c87", "level": "note", "message": {"text": "Possibly dead Python function: work"}, "properties": {"repobilityId": "c5b0e9acf413d08f", "scanner": "scanner-primary", "fingerprint": "6b5151ff51c90c87", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/wp6_redecode.py:258"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f7e37936ec279e91", "level": "note", "message": {"text": "Possibly dead Python function: build_model_adapter"}, "properties": {"repobilityId": "066c9bcb75e3a64f", "scanner": "scanner-primary", "fingerprint": "f7e37936ec279e91", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/draftcheck/ai/substrate.py:479"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-190c3852fde8679b", "level": "note", "message": {"text": "Possibly dead Python function: require_allowed_origin"}, "properties": {"repobilityId": "5765a789c73e67cf", "scanner": "scanner-primary", "fingerprint": "190c3852fde8679b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/draftcheck/api/auth.py:134"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f52ffeb46fd5792c", "level": "note", "message": {"text": "Possibly dead Python function: dep"}, "properties": {"repobilityId": "97535eb9200fecfe", "scanner": "scanner-primary", "fingerprint": "f52ffeb46fd5792c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/draftcheck/api/guest_quota.py:47"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4474fb098b5ee3ea", "level": "note", "message": {"text": "Possibly dead Python function: record"}, "properties": {"repobilityId": "954506f60a17269d", "scanner": "scanner-primary", "fingerprint": "4474fb098b5ee3ea", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/draftcheck/agent/memory.py:10"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6b91ce98c1ee8a09", "level": "note", "message": {"text": "Possibly dead Python function: stop"}, "properties": {"repobilityId": "ba22d90d343a0bd9", "scanner": "scanner-primary", "fingerprint": "6b91ce98c1ee8a09", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/draftcheck/agent/hermes.py:30"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-573ddfdd92637dac", "level": "note", "message": {"text": "Possibly dead Python function: decorate"}, "properties": {"repobilityId": "8ce426a62fb4ae76", "scanner": "scanner-primary", "fingerprint": "573ddfdd92637dac", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/draftcheck/jobs/__init__.py:34"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a3d36fdb7e6307a5", "level": "note", "message": {"text": "Possibly dead Python function: embed_chunk"}, "properties": {"repobilityId": "d56067e73e7b65aa", "scanner": "scanner-primary", "fingerprint": "a3d36fdb7e6307a5", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/draftcheck/jobs/embedding.py:88"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bb5efe80bde32bce", "level": "note", "message": {"text": "Possibly dead Python function: generate_source_chunk_embeddings"}, "properties": {"repobilityId": "9bd94ed745644807", "scanner": "scanner-primary", "fingerprint": "bb5efe80bde32bce", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/draftcheck/jobs/embedding.py:165"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b8145f3a7d4f26e0", "level": "note", "message": {"text": "Possibly dead Python function: import_gnaf_wa"}, "properties": {"repobilityId": "a62f79ee2dcc8785", "scanner": "scanner-primary", "fingerprint": "b8145f3a7d4f26e0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/draftcheck/domain/address/importers/gnaf_importer.py:67"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8354817630d132b9", "level": "note", "message": {"text": "Possibly dead Python function: run_validators"}, "properties": {"repobilityId": "e7c3a6f414d1c393", "scanner": "scanner-primary", "fingerprint": "8354817630d132b9", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/draftcheck/domain/rules/gate.py:44"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4271300b53cfbdfe", "level": "note", "message": {"text": "Possibly dead Python function: eval_gate_pass"}, "properties": {"repobilityId": "60ffcff387755295", "scanner": "scanner-primary", "fingerprint": "4271300b53cfbdfe", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/draftcheck/domain/rules/gate.py:101"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-860abbd35c4836a8", "level": "note", "message": {"text": "Possibly dead Python function: auto_promote"}, "properties": {"repobilityId": "e53025b68fa05e05", "scanner": "scanner-primary", "fingerprint": "860abbd35c4836a8", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/draftcheck/domain/rules/gate.py:195"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8e0dbe9977e64055", "level": "note", "message": {"text": "Possibly dead Python function: classify_clause"}, "properties": {"repobilityId": "5db4fc25aef29274", "scanner": "scanner-primary", "fingerprint": "8e0dbe9977e64055", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/draftcheck/domain/rules/service.py:125"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9f4a8988fb979843", "level": "note", "message": {"text": "Possibly dead Python function: enqueue_extraction_group"}, "properties": {"repobilityId": "05c11a551c7d9023", "scanner": "scanner-primary", "fingerprint": "9f4a8988fb979843", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/draftcheck/domain/rules/service.py:192"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b213050d4f10bf87", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 web/src/views/home.tsx:362"}, "properties": {"repobilityId": "cb2540709b6390ab", "scanner": "scanner-primary", "fingerprint": "b213050d4f10bf87", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-007fe80aa084272d", "level": "warning", "message": {"text": "Privileged port 587 in use"}, "properties": {"repobilityId": "a87a96c3b2e62c08", "scanner": "scanner-primary", "fingerprint": "007fe80aa084272d", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/test_identity_email.py"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1f5a866133e40744", "level": "warning", "message": {"text": "Dockerfile runs as root: infra/v3/db/Dockerfile"}, "properties": {"repobilityId": "ddd63a341530e18d", "scanner": "scanner-primary", "fingerprint": "1f5a866133e40744", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-43be33030bf67185", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: postgis/postgis:16-3.5"}, "properties": {"repobilityId": "262e215302049890", "scanner": "scanner-primary", "fingerprint": "43be33030bf67185", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infra/v3/db/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-efc4bde65ee7291d", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in web/scripts/test-live-launch-preview.mjs:4"}, "properties": {"repobilityId": "cbcdd90952503e6c", "scanner": "scanner-primary", "fingerprint": "efc4bde65ee7291d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/scripts/test-live-launch-preview.mjs"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-e864697c2740398a", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web/src/App.launch.test.tsx:23"}, "properties": {"repobilityId": "817bcc7f8ca776a6", "scanner": "scanner-primary", "fingerprint": "e864697c2740398a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/src/App.launch.test.tsx"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-9aba89b8f120420b", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in web/src/views/home.tsx:362"}, "properties": {"repobilityId": "d0387286652b9892", "scanner": "scanner-primary", "fingerprint": "9aba89b8f120420b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/src/views/home.tsx"}, "region": {"startLine": 362}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-b81c527268a01bd9", "level": "note", "message": {"text": "Very large file: src/draftcheck/db/models.py (2227 lines)"}, "properties": {"repobilityId": "746a240af3c98ffa", "scanner": "scanner-primary", "fingerprint": "b81c527268a01bd9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5125915fe9ae99fe", "level": "note", "message": {"text": "Very large file: src/draftcheck/domain/documents/parsing.py (2261 lines)"}, "properties": {"repobilityId": "56b208393397b6e0", "scanner": "scanner-primary", "fingerprint": "5125915fe9ae99fe", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "34efe4a7eb42c374", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "a965398e2fecc227", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "b730524a7ef9f9c1", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "ad7bc02faf373810", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "1985f2273a4e3b84", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "38ef73c571e01cbb", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "277a5c62a6dc2dbb", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-e725d2ab884fbd49", "level": "note", "message": {"text": "Multiple root agent instruction files without precedence"}, "properties": {"repobilityId": "1953db6c89508d22", "scanner": "scanner-primary", "fingerprint": "e725d2ab884fbd49", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["agent-instructions", "governance"]}}, {"ruleId": "scanner-e2953c1e57a23ce5", "level": "note", "message": {"text": "Legacy-named symbol `doc_legacy` in tests/test_document_parser_registry.py:33"}, "properties": {"repobilityId": "3e0eb3d85d1c05c2", "scanner": "scanner-primary", "fingerprint": "e2953c1e57a23ce5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-c8f83dcea5454654", "level": "note", "message": {"text": "Legacy-named symbol `test_v3_health_and_ready_are_mounted_only_under_api_v1` in tests/test_v3_api_shell.py:18"}, "properties": {"repobilityId": "d3f501eda462cdba", "scanner": "scanner-primary", "fingerprint": "c8f83dcea5454654", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-eb58833c02a996db", "level": "note", "message": {"text": "Legacy-named symbol `parser_real_sample_evidence_v1` in tests/test_v3_documents.py:64"}, "properties": {"repobilityId": "56c16b8d74066733", "scanner": "scanner-primary", "fingerprint": "eb58833c02a996db", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-e621770c453c37b5", "level": "note", "message": {"text": "Legacy-named symbol `parser_real_sample_evidence_v1` in tests/test_parser_sample_evidence.py:39"}, "properties": {"repobilityId": "809365e41fc163bc", "scanner": "scanner-primary", "fingerprint": "e621770c453c37b5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-63eee193814966ca", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/precommit_guard.py:52"}, "properties": {"repobilityId": "cd192ab4b7d11c30", "scanner": "scanner-primary", "fingerprint": "63eee193814966ca", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-f63acfa3206ee7fd", "level": "note", "message": {"text": "Legacy-named symbol `wp6_open_adversarial_review_v1` in scripts/wp6_apply_open_review.py:23"}, "properties": {"repobilityId": "af3689d3537475f2", "scanner": "scanner-primary", "fingerprint": "f63acfa3206ee7fd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-c40ccd97e9c64ede", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/wp2_spatial_load.py:38"}, "properties": {"repobilityId": "60e684af90d83b8c", "scanner": "scanner-primary", "fingerprint": "c40ccd97e9c64ede", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-86ad7bcf9fbe3691", "level": "note", "message": {"text": "Legacy-named symbol `wp6_sonnet_v1` in scripts/wp6_sonnet_postprocess.py:39"}, "properties": {"repobilityId": "70fa1bdb5869fbd0", "scanner": "scanner-primary", "fingerprint": "86ad7bcf9fbe3691", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-76aaa79bc9c5b143", "level": "note", "message": {"text": "Legacy-named symbol `wp6_lot_area_operator_curation_v1` in scripts/wp6_curate_lot_area_operators.py:46"}, "properties": {"repobilityId": "41dddd65fe4db843", "scanner": "scanner-primary", "fingerprint": "76aaa79bc9c5b143", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-8dae32b295053a0c", "level": "note", "message": {"text": "Legacy-named symbol `wp6_adjudicate_v2` in scripts/wp6_adjudicate.py:168"}, "properties": {"repobilityId": "21d38ab560cadf30", "scanner": "scanner-primary", "fingerprint": "8dae32b295053a0c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-fa8ca5f56c037d09", "level": "note", "message": {"text": "Legacy-named symbol `wp6_sonnet_v1` in scripts/wp6_solo_promote.py:48"}, "properties": {"repobilityId": "96d3e2aadfed0df1", "scanner": "scanner-primary", "fingerprint": "fa8ca5f56c037d09", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-45da7057b7377cbd", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/wp6_solo_promote.py:118"}, "properties": {"repobilityId": "dff4251fefb4dac7", "scanner": "scanner-primary", "fingerprint": "45da7057b7377cbd", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f43af9e902356290", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/wp6_cluster_keys.py:62"}, "properties": {"repobilityId": "6b61c7849683b601", "scanner": "scanner-primary", "fingerprint": "f43af9e902356290", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-39e1cee6dcc5a7e8", "level": "note", "message": {"text": "Legacy-named symbol `wp6_apply_adv_review_v1` in scripts/wp6_apply_adv_review.py:198"}, "properties": {"repobilityId": "77e283d8bb142b7d", "scanner": "scanner-primary", "fingerprint": "39e1cee6dcc5a7e8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-d60d1de1fb589906", "level": "note", "message": {"text": "Legacy-named symbol `parser_real_sample_evidence_v1` in scripts/parser_sample_evidence.py:20"}, "properties": {"repobilityId": "3e51fd6ab7f66959", "scanner": "scanner-primary", "fingerprint": "d60d1de1fb589906", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-4d5ff67c7f666d0f", "level": "note", "message": {"text": "Legacy-named symbol `lotfile_guest_usage_v1` in web/src/config.ts:3"}, "properties": {"repobilityId": "88ca90f41394c8cd", "scanner": "scanner-primary", "fingerprint": "4d5ff67c7f666d0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-79beb5b46f4b514f", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/draftcheck/governance/validators/check_results.py:158"}, "properties": {"repobilityId": "e260fd758dbada0a", "scanner": "scanner-primary", "fingerprint": "79beb5b46f4b514f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7f9e667d25b6f0b7", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/draftcheck/governance/validators/pipeline_steps.py:36"}, "properties": {"repobilityId": "5a10609ff151ce00", "scanner": "scanner-primary", "fingerprint": "7f9e667d25b6f0b7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0872e6237ac53c59", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/draftcheck/db/models.py:427"}, "properties": {"repobilityId": "4266838a1545efc7", "scanner": "scanner-primary", "fingerprint": "0872e6237ac53c59", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-74de6210585423ae", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/draftcheck/checks/registry.py:3"}, "properties": {"repobilityId": "98c724105d50bf2e", "scanner": "scanner-primary", "fingerprint": "74de6210585423ae", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4b9b93b0ad0df4de", "level": "none", "message": {"text": "Commented-code block (19 lines) in src/draftcheck/checks/category_map.py:110"}, "properties": {"repobilityId": "49ea7bf9afaeca20", "scanner": "scanner-primary", "fingerprint": "4b9b93b0ad0df4de", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-15fbcd9b9e3e76e1", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/draftcheck/extraction/vocabulary.py:30"}, "properties": {"repobilityId": "d5f69bbddb3757b4", "scanner": "scanner-primary", "fingerprint": "15fbcd9b9e3e76e1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-85cf14394032aa0a", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/draftcheck/extraction/adjudication.py:107"}, "properties": {"repobilityId": "99e4db099b27957f", "scanner": "scanner-primary", "fingerprint": "85cf14394032aa0a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b19e00a38b80a28a", "level": "none", "message": {"text": "Commented-code block (8 lines) in src/draftcheck/domain/address/postgis_store.py:575"}, "properties": {"repobilityId": "fe44ee61e99d452d", "scanner": "scanner-primary", "fingerprint": "b19e00a38b80a28a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-da0f087e7edefae9", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/draftcheck/domain/sources/library.py:741"}, "properties": {"repobilityId": "5d11aaecbd4a99b3", "scanner": "scanner-primary", "fingerprint": "da0f087e7edefae9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5b2466707e5b976c", "level": "note", "message": {"text": "Legacy-named symbol `parser_real_sample_evidence_v1` in src/draftcheck/domain/documents/parsing.py:63"}, "properties": {"repobilityId": "95567a524d57bc98", "scanner": "scanner-primary", "fingerprint": "5b2466707e5b976c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-4d223bfdf539b12d", "level": "note", "message": {"text": "42 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "5bbbd2b50dcb630d", "scanner": "scanner-primary", "fingerprint": "4d223bfdf539b12d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "5b81475882d6f073", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "4bdba6f04e6f7da8", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-02525d39071dd2c7", "level": "note", "message": {"text": "Near-duplicate function bodies in 5 places"}, "properties": {"repobilityId": "1af5e94e1cd9aae9", "scanner": "scanner-primary", "fingerprint": "02525d39071dd2c7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "5f1bb9cff2ec90c7", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "f4068997f949600b", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "a4230ae618240037", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "7476cc02d2576985", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "d31e696a9229d05f", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-02525d39071dd2c7", "level": "note", "message": {"text": "Near-duplicate function bodies in 5 places"}, "properties": {"repobilityId": "3d2810049fc89b8c", "scanner": "scanner-primary", "fingerprint": "02525d39071dd2c7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-02525d39071dd2c7", "level": "note", "message": {"text": "Near-duplicate function bodies in 5 places"}, "properties": {"repobilityId": "a978921f6011f5af", "scanner": "scanner-primary", "fingerprint": "02525d39071dd2c7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "d1726292099e86f8", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "f6d4168276365b8f", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "4c88250687a66ff5", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "64d9383ac058b9e7", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "80c08c2501e474ba", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "8d5243a2ff245b97", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "624ff2d171f0a10c", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "f949f346d167e1ee", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "fe9a7a95fb068416", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "1e27e44db49aa9a0", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-6f33079af17445b8", "level": "error", "message": {"text": "FastAPI POST `request_magic_link` without auth dependency \u2014 src/draftcheck/api/auth.py:191"}, "properties": {"repobilityId": "e3c850668f0ea5fc", "scanner": "scanner-primary", "fingerprint": "6f33079af17445b8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/draftcheck/api/auth.py"}, "region": {"startLine": 191}}}]}, {"ruleId": "scanner-3912ac1def37c69b", "level": "error", "message": {"text": "FastAPI POST `verify_magic_link` without auth dependency \u2014 src/draftcheck/api/auth.py:207"}, "properties": {"repobilityId": "43287af4704abea9", "scanner": "scanner-primary", "fingerprint": "3912ac1def37c69b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/draftcheck/api/auth.py"}, "region": {"startLine": 207}}}]}, {"ruleId": "scanner-a02c4ca64dab6094", "level": "error", "message": {"text": "FastAPI POST `dev_login` without auth dependency \u2014 src/draftcheck/api/auth.py:218"}, "properties": {"repobilityId": "2b98b64394f46d2d", "scanner": "scanner-primary", "fingerprint": "a02c4ca64dab6094", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/draftcheck/api/auth.py"}, "region": {"startLine": 218}}}]}, {"ruleId": "scanner-4c71d14ab08b7b2b", "level": "error", "message": {"text": "FastAPI POST `guest_login` without auth dependency \u2014 src/draftcheck/api/auth.py:278"}, "properties": {"repobilityId": "5e65e279298eb9b0", "scanner": "scanner-primary", "fingerprint": "4c71d14ab08b7b2b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/draftcheck/api/auth.py"}, "region": {"startLine": 278}}}]}, {"ruleId": "scanner-5271189ba09f6085", "level": "error", "message": {"text": "FastAPI POST `promote_rule_candidate` without auth dependency \u2014 src/draftcheck/api/v1.py:252"}, "properties": {"repobilityId": "abe937bd64afce8d", "scanner": "scanner-primary", "fingerprint": "5271189ba09f6085", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/draftcheck/api/v1.py"}, "region": {"startLine": 252}}}]}, {"ruleId": "scanner-62fce67bf05b1aad", "level": "error", "message": {"text": "FastAPI POST `reject_rule_candidate` without auth dependency \u2014 src/draftcheck/api/v1.py:257"}, "properties": {"repobilityId": "e54938c6704347fc", "scanner": "scanner-primary", "fingerprint": "62fce67bf05b1aad", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/draftcheck/api/v1.py"}, "region": {"startLine": 257}}}]}, {"ruleId": "scanner-f7b52d9d4ce9dc28", "level": "error", "message": {"text": "FastAPI POST `review_rule` without auth dependency \u2014 src/draftcheck/api/v1.py:267"}, "properties": {"repobilityId": "763279bf49ee4cce", "scanner": "scanner-primary", "fingerprint": "f7b52d9d4ce9dc28", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/draftcheck/api/v1.py"}, "region": {"startLine": 267}}}]}, {"ruleId": "scanner-26d65d90e038368b", "level": "error", "message": {"text": "FastAPI POST `parse_project_rfi` without auth dependency \u2014 src/draftcheck/api/v1.py:278"}, "properties": {"repobilityId": "1f2b2b3a4e68e006", "scanner": "scanner-primary", "fingerprint": "26d65d90e038368b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/draftcheck/api/v1.py"}, "region": {"startLine": 278}}}]}, {"ruleId": "scanner-4f902f0d1f4a1334", "level": "error", "message": {"text": "FastAPI POST `draft_rfi_response` without auth dependency \u2014 src/draftcheck/api/v1.py:288"}, "properties": {"repobilityId": "ee68b586ce054e2b", "scanner": "scanner-primary", "fingerprint": "4f902f0d1f4a1334", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/draftcheck/api/v1.py"}, "region": {"startLine": 288}}}]}, {"ruleId": "scanner-d64160d55a47a1e1", "level": "error", "message": {"text": "FastAPI POST `create_export` without auth dependency \u2014 src/draftcheck/api/v1.py:298"}, "properties": {"repobilityId": "0f967e7a767866be", "scanner": "scanner-primary", "fingerprint": "d64160d55a47a1e1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/draftcheck/api/v1.py"}, "region": {"startLine": 298}}}]}, {"ruleId": "scanner-5758c57d5de0aa55", "level": "error", "message": {"text": "FastAPI POST `resolve_review` without auth dependency \u2014 src/draftcheck/api/v1.py:318"}, "properties": {"repobilityId": "353dc246154968d3", "scanner": "scanner-primary", "fingerprint": "5758c57d5de0aa55", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/draftcheck/api/v1.py"}, "region": {"startLine": 318}}}]}, {"ruleId": "scanner-3b75ec67bc8f12c4", "level": "error", "message": {"text": "FastAPI POST `retry_agent_job` without auth dependency \u2014 src/draftcheck/api/v1.py:328"}, "properties": {"repobilityId": "07fb4f654d4e865b", "scanner": "scanner-primary", "fingerprint": "3b75ec67bc8f12c4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/draftcheck/api/v1.py"}, "region": {"startLine": 328}}}]}, {"ruleId": "scanner-c33bd5cdd60946ae", "level": "error", "message": {"text": "FastAPI POST `cancel_agent_job` without auth dependency \u2014 src/draftcheck/api/v1.py:333"}, "properties": {"repobilityId": "23ec9aceb5931132", "scanner": "scanner-primary", "fingerprint": "c33bd5cdd60946ae", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/draftcheck/api/v1.py"}, "region": {"startLine": 333}}}]}, {"ruleId": "scanner-63ffda473a804f17", "level": "error", "message": {"text": "FastAPI PUT `update_agent_memory` without auth dependency \u2014 src/draftcheck/api/v1.py:348"}, "properties": {"repobilityId": "7e3987651eaedad7", "scanner": "scanner-primary", "fingerprint": "63ffda473a804f17", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/draftcheck/api/v1.py"}, "region": {"startLine": 348}}}]}, {"ruleId": "scanner-577181738d48622b", "level": "error", "message": {"text": "FastAPI POST `activate_agent_skill` without auth dependency \u2014 src/draftcheck/api/v1.py:363"}, "properties": {"repobilityId": "8300aab2ef54ba76", "scanner": "scanner-primary", "fingerprint": "577181738d48622b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/draftcheck/api/v1.py"}, "region": {"startLine": 363}}}]}, {"ruleId": "scanner-c46e44facb67bedb", "level": "error", "message": {"text": "FastAPI POST `run_agent_evals` without auth dependency \u2014 src/draftcheck/api/v1.py:373"}, "properties": {"repobilityId": "9cd340ebe57e4a86", "scanner": "scanner-primary", "fingerprint": "c46e44facb67bedb", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/draftcheck/api/v1.py"}, "region": {"startLine": 373}}}]}, {"ruleId": "scanner-7a009b1a56794f45", "level": "note", "message": {"text": "Unused endpoint: POST /"}, "properties": {"repobilityId": "3fc5224ccf435ecc", "scanner": "scanner-primary", "fingerprint": "7a009b1a56794f45", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "38ac18f78519a41f", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-106f3e7fc5f65e4f", "level": "note", "message": {"text": "Unused endpoint: GET /{project_id}"}, "properties": {"repobilityId": "a55648feccfd995f", "scanner": "scanner-primary", "fingerprint": "106f3e7fc5f65e4f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-75726e5afbeebf0b", "level": "note", "message": {"text": "Unused endpoint: PATCH /{project_id}"}, "properties": {"repobilityId": "7af571427e383810", "scanner": "scanner-primary", "fingerprint": "75726e5afbeebf0b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b9174fa868399f10", "level": "note", "message": {"text": "Unused endpoint: DELETE /{project_id}"}, "properties": {"repobilityId": "789a4d92c8a913dd", "scanner": "scanner-primary", "fingerprint": "b9174fa868399f10", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b2dc119a7130e939", "level": "note", "message": {"text": "Unused endpoint: POST /{project_id}/property/override"}, "properties": {"repobilityId": "5b25793a43e9d9b3", "scanner": "scanner-primary", "fingerprint": "b2dc119a7130e939", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2d91aaa81332f9fd", "level": "note", "message": {"text": "Unused endpoint: POST /{project_id}/proposal"}, "properties": {"repobilityId": "eed599011a6d6929", "scanner": "scanner-primary", "fingerprint": "2d91aaa81332f9fd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ea36ea6caf451096", "level": "note", "message": {"text": "Unused endpoint: GET /address/search"}, "properties": {"repobilityId": "e10c403b08ae4626", "scanner": "scanner-primary", "fingerprint": "ea36ea6caf451096", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e02fa36c309f294b", "level": "note", "message": {"text": "Unused endpoint: POST /projects/{project_id}/resolve-address"}, "properties": {"repobilityId": "6daf03264d22f832", "scanner": "scanner-primary", "fingerprint": "e02fa36c309f294b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6980ca314959e417", "level": "note", "message": {"text": "Unused endpoint: GET /projects/{project_id}/property"}, "properties": {"repobilityId": "0f7d73c3d0441afe", "scanner": "scanner-primary", "fingerprint": "6980ca314959e417", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e02f8c59b8ded7ec", "level": "note", "message": {"text": "Unused endpoint: POST /auth/magic-link/request"}, "properties": {"repobilityId": "cf0f3e75b3c7a766", "scanner": "scanner-primary", "fingerprint": "e02f8c59b8ded7ec", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4fb2564af590f75f", "level": "note", "message": {"text": "Unused endpoint: POST /auth/magic-link/verify"}, "properties": {"repobilityId": "585dd18311718ab0", "scanner": "scanner-primary", "fingerprint": "4fb2564af590f75f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b2d21770371f71a3", "level": "note", "message": {"text": "Unused endpoint: POST /auth/dev-login"}, "properties": {"repobilityId": "f31402123634c30d", "scanner": "scanner-primary", "fingerprint": "b2d21770371f71a3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-003a8b005c19bfda", "level": "note", "message": {"text": "Unused endpoint: POST /auth/guest"}, "properties": {"repobilityId": "b1ee1f8cff9bb348", "scanner": "scanner-primary", "fingerprint": "003a8b005c19bfda", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b09fff413cd9f079", "level": "note", "message": {"text": "Unused endpoint: GET /auth/session"}, "properties": {"repobilityId": "edd9c41c7f34abfc", "scanner": "scanner-primary", "fingerprint": "b09fff413cd9f079", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c059f57186114027", "level": "note", "message": {"text": "Unused endpoint: POST /auth/logout"}, "properties": {"repobilityId": "805428b4fbac9f2c", "scanner": "scanner-primary", "fingerprint": "c059f57186114027", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-522aca098fa53cf1", "level": "note", "message": {"text": "Unused endpoint: POST /projects/{project_id}/run"}, "properties": {"repobilityId": "76e215637c860512", "scanner": "scanner-primary", "fingerprint": "522aca098fa53cf1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-005db54230e76841", "level": "note", "message": {"text": "Unused endpoint: GET /projects/{project_id}/matrix"}, "properties": {"repobilityId": "8f4503a84de53142", "scanner": "scanner-primary", "fingerprint": "005db54230e76841", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f765590c3fd49099", "level": "note", "message": {"text": "Unused endpoint: POST /results/{result_id}/override"}, "properties": {"repobilityId": "175c4cf7aa698878", "scanner": "scanner-primary", "fingerprint": "f765590c3fd49099", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-55f8c8cf959a5664", "level": "note", "message": {"text": "Unused endpoint: GET /runs/{run_id}"}, "properties": {"repobilityId": "7eec29ec5010650d", "scanner": "scanner-primary", "fingerprint": "55f8c8cf959a5664", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-02d460f9c508cb7a", "level": "note", "message": {"text": "Unused endpoint: POST /sources/import"}, "properties": {"repobilityId": "beff1f4c69178d14", "scanner": "scanner-primary", "fingerprint": "02d460f9c508cb7a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9617aa24fd377881", "level": "note", "message": {"text": "Unused endpoint: GET /sources"}, "properties": {"repobilityId": "3c66757f5bbd6f1b", "scanner": "scanner-primary", "fingerprint": "9617aa24fd377881", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-22e6a4dd12cc8751", "level": "note", "message": {"text": "Unused endpoint: GET /sources/freshness"}, "properties": {"repobilityId": "e1d27fd4cc136521", "scanner": "scanner-primary", "fingerprint": "22e6a4dd12cc8751", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-31d9e484e08dfe3f", "level": "note", "message": {"text": "Unused endpoint: GET /sources/ingestion-status"}, "properties": {"repobilityId": "8d2fd1fd8764ff6d", "scanner": "scanner-primary", "fingerprint": "31d9e484e08dfe3f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-172e07800a837b1b", "level": "note", "message": {"text": "Unused endpoint: GET /sources/review-worklist"}, "properties": {"repobilityId": "12da927380c10591", "scanner": "scanner-primary", "fingerprint": "172e07800a837b1b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5128238b944d9319", "level": "note", "message": {"text": "Unused endpoint: GET /sources/quality-report"}, "properties": {"repobilityId": "7ed04e4df3ff1873", "scanner": "scanner-primary", "fingerprint": "5128238b944d9319", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7dcd188c65e4fb72", "level": "note", "message": {"text": "Unused endpoint: GET /sources/{source_id}/versions/{source_version_id}/review-packet"}, "properties": {"repobilityId": "491dfc62039f1b66", "scanner": "scanner-primary", "fingerprint": "7dcd188c65e4fb72", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6df0cb5c69bfa696", "level": "note", "message": {"text": "Unused endpoint: GET /sources/{source_id}"}, "properties": {"repobilityId": "e587c1a8a83f05b3", "scanner": "scanner-primary", "fingerprint": "6df0cb5c69bfa696", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d36019a83393ae10", "level": "note", "message": {"text": "Unused endpoint: GET /sources/{source_id}/versions"}, "properties": {"repobilityId": "bcbc7ec38bdd1942", "scanner": "scanner-primary", "fingerprint": "d36019a83393ae10", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8b92a01e9875887c", "level": "note", "message": {"text": "Unused endpoint: POST /sources/{source_id}/review"}, "properties": {"repobilityId": "93e41406e49b0017", "scanner": "scanner-primary", "fingerprint": "8b92a01e9875887c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b091532b993e22b5", "level": "note", "message": {"text": "Unused endpoint: POST /sources/{source_id}/refresh"}, "properties": {"repobilityId": "cf04d05b79734a66", "scanner": "scanner-primary", "fingerprint": "b091532b993e22b5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0416e04a84bae50d", "level": "note", "message": {"text": "Unused endpoint: POST /search/chunks"}, "properties": {"repobilityId": "952b85bd667ae8b1", "scanner": "scanner-primary", "fingerprint": "0416e04a84bae50d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-721aeb68154b4b65", "level": "note", "message": {"text": "Unused endpoint: POST /search/ask"}, "properties": {"repobilityId": "f1cb97b9fa3d19d2", "scanner": "scanner-primary", "fingerprint": "721aeb68154b4b65", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f953ff48b9e2933c", "level": "note", "message": {"text": "Unused endpoint: POST /assistant"}, "properties": {"repobilityId": "7a7651cf87588f32", "scanner": "scanner-primary", "fingerprint": "f953ff48b9e2933c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ab7ce0fa328c93ea", "level": "note", "message": {"text": "Unused endpoint: GET /candidates"}, "properties": {"repobilityId": "637edc4480a608a6", "scanner": "scanner-primary", "fingerprint": "ab7ce0fa328c93ea", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6d0dcf0565664c66", "level": "note", "message": {"text": "Unused endpoint: GET /candidates/{candidate_id}"}, "properties": {"repobilityId": "523bd9f11f9586f7", "scanner": "scanner-primary", "fingerprint": "6d0dcf0565664c66", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6be8f9a37fd44a54", "level": "note", "message": {"text": "Unused endpoint: POST /candidates/{candidate_id}/review"}, "properties": {"repobilityId": "a578ab7ba512c906", "scanner": "scanner-primary", "fingerprint": "6be8f9a37fd44a54", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1d8da59b2047b102", "level": "note", "message": {"text": "Unused endpoint: GET /clauses"}, "properties": {"repobilityId": "a326c48209a895fd", "scanner": "scanner-primary", "fingerprint": "1d8da59b2047b102", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8edb4fe434de6f50", "level": "note", "message": {"text": "Unused endpoint: GET /clauses/{clause_id}"}, "properties": {"repobilityId": "19d5bbe27a2c33eb", "scanner": "scanner-primary", "fingerprint": "8edb4fe434de6f50", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0c948ea72b525d34", "level": "note", "message": {"text": "Unused endpoint: GET /{rule_id}"}, "properties": {"repobilityId": "65f15065a90f5473", "scanner": "scanner-primary", "fingerprint": "0c948ea72b525d34", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-89850765108ae647", "level": "note", "message": {"text": "Unused endpoint: POST /{rule_id}/review"}, "properties": {"repobilityId": "42e40540dcca6d49", "scanner": "scanner-primary", "fingerprint": "89850765108ae647", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-44aa02cbf0168dbf", "level": "note", "message": {"text": "Unused endpoint: POST /{rule_id}/approve"}, "properties": {"repobilityId": "b275653450962d2c", "scanner": "scanner-primary", "fingerprint": "44aa02cbf0168dbf", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ef629ad75f4cc3f0", "level": "note", "message": {"text": "Unused endpoint: GET /documents/parsers"}, "properties": {"repobilityId": "95c6b894888b076a", "scanner": "scanner-primary", "fingerprint": "ef629ad75f4cc3f0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c0d17a25c6cb4bc1", "level": "note", "message": {"text": "Unused endpoint: GET /documents/parsers/accuracy"}, "properties": {"repobilityId": "6b8fa96036b8d671", "scanner": "scanner-primary", "fingerprint": "c0d17a25c6cb4bc1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b1c8fc58a4e17836", "level": "note", "message": {"text": "Unused endpoint: POST /documents/upload"}, "properties": {"repobilityId": "9be7249e319ca507", "scanner": "scanner-primary", "fingerprint": "b1c8fc58a4e17836", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c0212e3558db7bc1", "level": "note", "message": {"text": "Unused endpoint: PATCH /documents/{doc_id}/facts/{fact_id}"}, "properties": {"repobilityId": "670fca4f2599d4db", "scanner": "scanner-primary", "fingerprint": "c0212e3558db7bc1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d1f1b5c9c9e165e5", "level": "note", "message": {"text": "Unused endpoint: POST /documents/{doc_id}/facts/{fact_id}/promote"}, "properties": {"repobilityId": "d5d5d8ed1b40430b", "scanner": "scanner-primary", "fingerprint": "d1f1b5c9c9e165e5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0b9dc27a48a47631", "level": "note", "message": {"text": "Unused endpoint: GET /documents/{document_id}/persisted-facts"}, "properties": {"repobilityId": "5498499cd41ce99e", "scanner": "scanner-primary", "fingerprint": "0b9dc27a48a47631", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-23e7560d68629300", "level": "note", "message": {"text": "Unused endpoint: GET /documents/projects/{project_id}/evidence-search"}, "properties": {"repobilityId": "38d9a70319bc7ad7", "scanner": "scanner-primary", "fingerprint": "23e7560d68629300", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a255586169af3e81", "level": "note", "message": {"text": "Unused endpoint: POST /documents/projects/{project_id}/upload"}, "properties": {"repobilityId": "9c895bc13015d1b5", "scanner": "scanner-primary", "fingerprint": "a255586169af3e81", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}