{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-62b79a345331f74c", "name": "Insecure pattern 'direct_innerhtml_assignment' in test-tracking.html:54", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in test-tracking.html:54"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dca321747d96b597", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 2 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-11825279136b53a3", "name": "CI is configured but no tests are detected", "shortDescription": {"text": "CI is configured but no tests are detected"}, "fullDescription": {"text": "A CI pipeline exists, but the scan found no test files to gate. Opus labeled this generated-code pattern as config theater: release machinery exists, but it has little behavioral signal."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, tests. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, tests. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-10b484c7534aada8", "name": "Agent authority lacks a verifier contract: .claude/logs/agent-2-planning-5.0.2-beta.9-notification-resolver-schema.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/logs/agent-2-planning-5.0.2-beta.9-notification-resolver-schema.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7c169a4090f19d7d", "name": "Agent authority lacks a verifier contract: .claude/logs/agent-2-planning-5.0.2-beta.15.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/logs/agent-2-planning-5.0.2-beta.15.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ac6dee9274ae5a4", "name": "Agent authority lacks a verifier contract: .claude/logs/plugin-agent-1-skills-deltas-docs-commit-b2c92103.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/logs/plugin-agent-1-skills-deltas-docs-commit-b2c92103.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7ad7296c87959bbe", "name": "Agent authority lacks a verifier contract: .claude/logs/agent-7-skills-deltas-5.0.1-beta.4-notifications.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/logs/agent-7-skills-deltas-5.0.1-beta.4-notifications.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d5a1b869a4c579bb", "name": "Agent authority lacks a verifier contract: .claude/logs/agent-2-planning-5.0.2-beta.21.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/logs/agent-2-planning-5.0.2-beta.21.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2b51ffdf5610904e", "name": "Agent authority lacks a verifier contract: .claude/logs/plugin-agent-1-skills-deltas-merge-f367606.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/logs/plugin-agent-1-skills-deltas-merge-f367606.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4f2aef497ff8945e", "name": "Agent authority lacks a verifier contract: .claude/logs/plugin-agent-1-skills-deltas-docs-commit-cc83d17-addendum.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/logs/plugin-agent-1-skills-deltas-docs-commit-cc83d17-addendum.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8bfe10646de6b160", "name": "Agent authority lacks a verifier contract: .claude/logs/agent-6-qa-v4.5.4.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/logs/agent-6-qa-v4.5.4.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4f1dbe566159a5c4", "name": "Agent authority lacks a verifier contract: .claude/logs/agent-2-planning-4.6.7-beta.1.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/logs/agent-2-planning-4.6.7-beta.1.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-968b891eca187117", "name": "Agent authority lacks a verifier contract: .claude/logs/agent-2-planning-4.7.2-beta.1.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/logs/agent-2-planning-4.7.2-beta.1.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-42855b167dfb53c3", "name": "Agent authority lacks a verifier contract: .claude/logs/agent-6-qa-5.0.2-beta.11.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/logs/agent-6-qa-5.0.2-beta.11.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b0f84e742c3de673", "name": "Agent authority lacks a verifier contract: .claude/logs/agent-2-planning-5.0.2-beta.7-activity-service-api.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/logs/agent-2-planning-5.0.2-beta.7-activity-service-api.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bfcee7dd58980c1a", "name": "Agent authority lacks a verifier contract: .claude/logs/agent-6-qa-v4.5.8.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/logs/agent-6-qa-v4.5.8.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-638ed7f0f7b6daa1", "name": "Agent authority lacks a verifier contract: .claude/logs/plugin-agent-1-skills-deltas-docs-commit-cc83d17d.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/logs/plugin-agent-1-skills-deltas-docs-commit-cc83d17d.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e3f5d3cc72897dea", "name": "Agent instruction/config may expose a secret: .claude/logs/agent-2-planning-v4.5.4.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/logs/agent-2-planning-v4.5.4.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-57f699ecb5e27604", "name": "Agent authority lacks a verifier contract: .claude/logs/agent-5-alignment-4.5.9-beta.1.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/logs/agent-5-alignment-4.5.9-beta.1.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-583a6af30278b887", "name": "Agent authority lacks a verifier contract: .claude/logs/agent-7-qa-v5.0.2-beta.19.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/logs/agent-7-qa-v5.0.2-beta.19.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-700157bf747ab3ef", "name": "Agent authority lacks a verifier contract: .claude/agents/Agent-4-ui-customization-updater.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agents/Agent-4-ui-customization-updater.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e2d16c8d93d1a667", "name": "Agent authority lacks a verifier contract: .claude/agents/Agent-5-primitives-updater.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agents/Agent-5-primitives-updater.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ca9a22e53ab42afe", "name": "Agent authority lacks a verifier contract: .claude/agents/skills-sync/Agent-2d-backend-skill-updater.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agents/skills-sync/Agent-2d-backend-skill-updater.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7de243de1bd0896e", "name": "Agent authority lacks a verifier contract: .claude/agents/skills-sync/Agent-1-docs-diff-planner.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agents/skills-sync/Agent-1-docs-diff-planner.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-481e6c2dadde7d76", "name": "Agent authority lacks a verifier contract: .claude/agents/skills-sync/Agent-2e-infra-skill-updater.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agents/skills-sync/Agent-2e-infra-skill-updater.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-851785941c23ba89", "name": "Agent instruction contains unpinned remote install: .cursor/rules/docs-rules.mdc", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .cursor/rules/docs-rules.mdc"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/22139"}, "properties": {"repository": "velt-js/docs", "repoUrl": "https://github.com/velt-js/docs", "branch": "main"}, "results": [{"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-62b79a345331f74c", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in test-tracking.html:54"}, "properties": {"repobilityId": "e4c63fc57727d518", "scanner": "scanner-primary", "fingerprint": "62b79a345331f74c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "test-tracking.html"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-dca321747d96b597", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0e53435d1a1b1b85", "scanner": "scanner-primary", "fingerprint": "dca321747d96b597", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs-sync-skills.yml"}, "region": {"startLine": 69}}}]}, {"ruleId": "scanner-dca321747d96b597", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0e53435d1a1b1b85", "scanner": "scanner-primary", "fingerprint": "dca321747d96b597", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs-sync-skills.yml"}, "region": {"startLine": 75}}}]}, {"ruleId": "scanner-dca321747d96b597", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "268c4be9369abb17", "scanner": "scanner-primary", "fingerprint": "dca321747d96b597", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs-sync-skills.yml"}, "region": {"startLine": 107}}}]}, {"ruleId": "scanner-dca321747d96b597", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a337bc4de066012d", "scanner": "scanner-primary", "fingerprint": "dca321747d96b597", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs-sync-skills.yml"}, "region": {"startLine": 168}}}]}, {"ruleId": "scanner-dca321747d96b597", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0e53435d1a1b1b85", "scanner": "scanner-primary", "fingerprint": "dca321747d96b597", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs-sync-skills.yml"}, "region": {"startLine": 193}}}]}, {"ruleId": "scanner-dca321747d96b597", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0e53435d1a1b1b85", "scanner": "scanner-primary", "fingerprint": "dca321747d96b597", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs-sync-skills.yml"}, "region": {"startLine": 199}}}]}, {"ruleId": "scanner-dca321747d96b597", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "268c4be9369abb17", "scanner": "scanner-primary", "fingerprint": "dca321747d96b597", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs-sync-skills.yml"}, "region": {"startLine": 212}}}]}, {"ruleId": "scanner-dca321747d96b597", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "60f3f859291eddf7", "scanner": "scanner-primary", "fingerprint": "dca321747d96b597", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs-sync-skills.yml"}, "region": {"startLine": 220}}}]}, {"ruleId": "scanner-dca321747d96b597", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a337bc4de066012d", "scanner": "scanner-primary", "fingerprint": "dca321747d96b597", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs-sync-skills.yml"}, "region": {"startLine": 263}}}]}, {"ruleId": "scanner-dca321747d96b597", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a337bc4de066012d", "scanner": "scanner-primary", "fingerprint": "dca321747d96b597", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs-sync-skills.yml"}, "region": {"startLine": 273}}}]}, {"ruleId": "scanner-dca321747d96b597", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0e53435d1a1b1b85", "scanner": "scanner-primary", "fingerprint": "dca321747d96b597", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs-sync-skills.yml"}, "region": {"startLine": 291}}}]}, {"ruleId": "scanner-dca321747d96b597", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0e53435d1a1b1b85", "scanner": "scanner-primary", "fingerprint": "dca321747d96b597", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs-sync-skills.yml"}, "region": {"startLine": 297}}}]}, {"ruleId": "scanner-dca321747d96b597", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "268c4be9369abb17", "scanner": "scanner-primary", "fingerprint": "dca321747d96b597", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs-sync-skills.yml"}, "region": {"startLine": 305}}}]}, {"ruleId": "scanner-dca321747d96b597", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "60f3f859291eddf7", "scanner": "scanner-primary", "fingerprint": "dca321747d96b597", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs-sync-skills.yml"}, "region": {"startLine": 364}}}]}, {"ruleId": "scanner-dca321747d96b597", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "60f3f859291eddf7", "scanner": "scanner-primary", "fingerprint": "dca321747d96b597", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs-sync-skills.yml"}, "region": {"startLine": 371}}}]}, {"ruleId": "scanner-dca321747d96b597", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a337bc4de066012d", "scanner": "scanner-primary", "fingerprint": "dca321747d96b597", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docs-sync-skills.yml"}, "region": {"startLine": 486}}}]}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "c7fb63b8f656a987", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-11825279136b53a3", "level": "warning", "message": {"text": "CI is configured but no tests are detected"}, "properties": {"repobilityId": "d5796c9ab8daa3b0", "scanner": "scanner-primary", "fingerprint": "11825279136b53a3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "ci", "config-theater", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "c681436ce6ec8a80", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "4a6bafac729d85c8", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "f6b65be2bedd6f6f", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "e077166dbaf3ca87", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-10b484c7534aada8", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/logs/agent-2-planning-5.0.2-beta.9-notification-resolver-schema.md"}, "properties": {"repobilityId": "0a60a424ad970bea", "scanner": "scanner-primary", "fingerprint": "10b484c7534aada8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/logs/agent-2-planning-5.0.2-beta.9-notification-resolver-schema.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7c169a4090f19d7d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/logs/agent-2-planning-5.0.2-beta.15.md"}, "properties": {"repobilityId": "4378d2ca5c6a6cdb", "scanner": "scanner-primary", "fingerprint": "7c169a4090f19d7d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/logs/agent-2-planning-5.0.2-beta.15.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ac6dee9274ae5a4", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/logs/plugin-agent-1-skills-deltas-docs-commit-b2c92103.json"}, "properties": {"repobilityId": "a2480b48ca47d117", "scanner": "scanner-primary", "fingerprint": "3ac6dee9274ae5a4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/logs/plugin-agent-1-skills-deltas-docs-commit-b2c92103.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7ad7296c87959bbe", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/logs/agent-7-skills-deltas-5.0.1-beta.4-notifications.json"}, "properties": {"repobilityId": "7d048bf85849b58e", "scanner": "scanner-primary", "fingerprint": "7ad7296c87959bbe", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/logs/agent-7-skills-deltas-5.0.1-beta.4-notifications.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d5a1b869a4c579bb", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/logs/agent-2-planning-5.0.2-beta.21.md"}, "properties": {"repobilityId": "333d6c319ab4ad67", "scanner": "scanner-primary", "fingerprint": "d5a1b869a4c579bb", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/logs/agent-2-planning-5.0.2-beta.21.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2b51ffdf5610904e", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/logs/plugin-agent-1-skills-deltas-merge-f367606.json"}, "properties": {"repobilityId": "6a46dbff8b9372f2", "scanner": "scanner-primary", "fingerprint": "2b51ffdf5610904e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/logs/plugin-agent-1-skills-deltas-merge-f367606.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4f2aef497ff8945e", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/logs/plugin-agent-1-skills-deltas-docs-commit-cc83d17-addendum.json"}, "properties": {"repobilityId": "089f8045e4ba252d", "scanner": "scanner-primary", "fingerprint": "4f2aef497ff8945e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/logs/plugin-agent-1-skills-deltas-docs-commit-cc83d17-addendum.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8bfe10646de6b160", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/logs/agent-6-qa-v4.5.4.md"}, "properties": {"repobilityId": "900f70b633016d9c", "scanner": "scanner-primary", "fingerprint": "8bfe10646de6b160", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/logs/agent-6-qa-v4.5.4.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4f1dbe566159a5c4", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/logs/agent-2-planning-4.6.7-beta.1.md"}, "properties": {"repobilityId": "44a8d8c268dc536c", "scanner": "scanner-primary", "fingerprint": "4f1dbe566159a5c4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/logs/agent-2-planning-4.6.7-beta.1.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-968b891eca187117", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/logs/agent-2-planning-4.7.2-beta.1.md"}, "properties": {"repobilityId": "7a5141f7d45fc4ff", "scanner": "scanner-primary", "fingerprint": "968b891eca187117", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/logs/agent-2-planning-4.7.2-beta.1.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-42855b167dfb53c3", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/logs/agent-6-qa-5.0.2-beta.11.md"}, "properties": {"repobilityId": "ed043a85e3610b48", "scanner": "scanner-primary", "fingerprint": "42855b167dfb53c3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/logs/agent-6-qa-5.0.2-beta.11.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b0f84e742c3de673", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/logs/agent-2-planning-5.0.2-beta.7-activity-service-api.md"}, "properties": {"repobilityId": "05efe9f3980d119d", "scanner": "scanner-primary", "fingerprint": "b0f84e742c3de673", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/logs/agent-2-planning-5.0.2-beta.7-activity-service-api.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bfcee7dd58980c1a", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/logs/agent-6-qa-v4.5.8.md"}, "properties": {"repobilityId": "76733b96d01558e4", "scanner": "scanner-primary", "fingerprint": "bfcee7dd58980c1a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/logs/agent-6-qa-v4.5.8.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-638ed7f0f7b6daa1", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/logs/plugin-agent-1-skills-deltas-docs-commit-cc83d17d.json"}, "properties": {"repobilityId": "c1603d94912d1ff5", "scanner": "scanner-primary", "fingerprint": "638ed7f0f7b6daa1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/logs/plugin-agent-1-skills-deltas-docs-commit-cc83d17d.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e3f5d3cc72897dea", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/logs/agent-2-planning-v4.5.4.md"}, "properties": {"repobilityId": "324eb75c61610ec0", "scanner": "scanner-primary", "fingerprint": "e3f5d3cc72897dea", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/logs/agent-2-planning-v4.5.4.md"}, "region": {"startLine": 440}}}]}, {"ruleId": "scanner-57f699ecb5e27604", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/logs/agent-5-alignment-4.5.9-beta.1.md"}, "properties": {"repobilityId": "e0acbc46fd6ddd13", "scanner": "scanner-primary", "fingerprint": "57f699ecb5e27604", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/logs/agent-5-alignment-4.5.9-beta.1.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-583a6af30278b887", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/logs/agent-7-qa-v5.0.2-beta.19.md"}, "properties": {"repobilityId": "a4b71afd53e6f474", "scanner": "scanner-primary", "fingerprint": "583a6af30278b887", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/logs/agent-7-qa-v5.0.2-beta.19.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-700157bf747ab3ef", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agents/Agent-4-ui-customization-updater.md"}, "properties": {"repobilityId": "7a07dae3e0de9eed", "scanner": "scanner-primary", "fingerprint": "700157bf747ab3ef", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/Agent-4-ui-customization-updater.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e2d16c8d93d1a667", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agents/Agent-5-primitives-updater.md"}, "properties": {"repobilityId": "8de0a2e55fe92aa6", "scanner": "scanner-primary", "fingerprint": "e2d16c8d93d1a667", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/Agent-5-primitives-updater.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ca9a22e53ab42afe", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agents/skills-sync/Agent-2d-backend-skill-updater.md"}, "properties": {"repobilityId": "5f842a42e6a5a85c", "scanner": "scanner-primary", "fingerprint": "ca9a22e53ab42afe", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/skills-sync/Agent-2d-backend-skill-updater.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7de243de1bd0896e", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agents/skills-sync/Agent-1-docs-diff-planner.md"}, "properties": {"repobilityId": "fd1eaae650a5465e", "scanner": "scanner-primary", "fingerprint": "7de243de1bd0896e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/skills-sync/Agent-1-docs-diff-planner.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-481e6c2dadde7d76", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agents/skills-sync/Agent-2e-infra-skill-updater.md"}, "properties": {"repobilityId": "716c6935580cba2b", "scanner": "scanner-primary", "fingerprint": "481e6c2dadde7d76", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/skills-sync/Agent-2e-infra-skill-updater.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-851785941c23ba89", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .cursor/rules/docs-rules.mdc"}, "properties": {"repobilityId": "f7a15bdbcc95e3bf", "scanner": "scanner-primary", "fingerprint": "851785941c23ba89", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "cursor_rule"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".cursor/rules/docs-rules.mdc"}, "region": {"startLine": 180}}}]}]}]}