{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-212708e1c0cff933", "name": "Possibly dead Python function: patched_get_inherited", "shortDescription": {"text": "Possibly dead Python function: patched_get_inherited"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-84c3ebc1c26207ce", "name": "Possibly dead Python function: sort_key", "shortDescription": {"text": "Possibly dead Python function: sort_key"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-164f03045496f897", "name": "Possibly dead Python function: remove_trailing_contamination", "shortDescription": {"text": "Possibly dead Python function: remove_trailing_contamination"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c3de86bbfc499ef0", "name": "Possibly dead Python function: is_regional_reporter", "shortDescription": {"text": "Possibly dead Python function: is_regional_reporter"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8f8464cb27ae076e", "name": "Insecure pattern 'direct_innerhtml_assignment' in web/static/index.html:430", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web/static/index.html:430"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e39e871eb7b8c091", "name": "Insecure pattern 'direct_innerhtml_assignment' in web/static/get.html:459", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web/static/get.html:459"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2ba729965c4509c0", "name": "Insecure pattern 'local_storage_auth_token' in web/static/get.html:410", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in web/static/get.html:410"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aeacdea4a1554aa5", "name": "Insecure pattern 'direct_innerhtml_assignment' in web/static/qc.html:520", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web/static/qc.html:520"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-daadbfc3f1c1caad", "name": "Very large file: tests/test_verifier.py (3901 lines)", "shortDescription": {"text": "Very large file: tests/test_verifier.py (3901 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1b4b23bd5455627b", "name": "Very large file: tests/test_async_verifier.py (2184 lines)", "shortDescription": {"text": "Very large file: tests/test_async_verifier.py (2184 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0ed4360e7c643df9", "name": "Very large file: tests/test_proposition_pipeline.py (2013 lines)", "shortDescription": {"text": "Very large file: tests/test_proposition_pipeline.py (2013 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6636e790283e1c5b", "name": "Very large file: web/app.py (1549 lines)", "shortDescription": {"text": "Very large file: web/app.py (1549 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-13750c1d026fd322", "name": "Very large file: src/citation_verifier/proposition_pipeline.py (2259 lines)", "shortDescription": {"text": "Very large file: src/citation_verifier/proposition_pipeline.py (2259 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd8b459ac1fdc117", "name": "Very large file: src/citation_verifier/verifier.py (3639 lines)", "shortDescription": {"text": "Very large file: src/citation_verifier/verifier.py (3639 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 253 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing ci. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-122f91b7f2906dc4", "name": "Agent authority lacks a verifier contract: .claude/settings.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2dcb3af2fef049cf", "name": "Agent authority lacks a verifier contract: .claude/skills/pdf-processing-anthropic/references/REFERENCE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/pdf-processing-anthropic/references/REFERENCE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-84114c9f11e46c5a", "name": "Commented-code block (6 lines) in tests/build_assessment_corpora.py:105", "shortDescription": {"text": "Commented-code block (6 lines) in tests/build_assessment_corpora.py:105"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-628718d32bc2d57e", "name": "Commented-code block (5 lines) in tests/test_verifier.py:1160", "shortDescription": {"text": "Commented-code block (5 lines) in tests/test_verifier.py:1160"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-83ab5f709d411a0e", "name": "Commented-code block (8 lines) in tests/verify_from_csv.py:427", "shortDescription": {"text": "Commented-code block (8 lines) in tests/verify_from_csv.py:427"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7949fd5d58a854ef", "name": "Legacy-named symbol `test_hint_config_rejected_for_v1` in tests/test_ab_runner.py:50", "shortDescription": {"text": "Legacy-named symbol `test_hint_config_rejected_for_v1` in tests/test_ab_runner.py:50"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-46e7e177a373612b", "name": "Commented-code block (5 lines) in tests/test_cli_verify_json.py:48", "shortDescription": {"text": "Commented-code block (5 lines) in tests/test_cli_verify_json.py:48"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8bf1b46113e48297", "name": "Commented-code block (5 lines) in tests/build_charlotin_corpus.py:59", "shortDescription": {"text": "Commented-code block (5 lines) in tests/build_charlotin_corpus.py:59"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-00aabc0631572038", "name": "Legacy-named symbol `test_single_object_fanout_unchanged_for_v1` in tests/test_executor.py:383", "shortDescription": {"text": "Legacy-named symbol `test_single_object_fanout_unchanged_for_v1` in tests/test_executor.py:383"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2a7b8dbfd1e73df0", "name": "Commented-code block (5 lines) in tests/test_false_positives.py:35", "shortDescription": {"text": "Commented-code block (5 lines) in tests/test_false_positives.py:35"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-02c4bb00147a9ad9", "name": "Commented-code block (5 lines) in tests/mock_spec_harness.py:31", "shortDescription": {"text": "Commented-code block (5 lines) in tests/mock_spec_harness.py:31"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0fffd10854b938ca", "name": "Legacy-named symbol `test_withers_v2` in tests/test_assessment_regression.py:105", "shortDescription": {"text": "Legacy-named symbol `test_withers_v2` in tests/test_assessment_regression.py:105"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-973de2a9eafe7269", "name": "Legacy-named symbol `recorded_v1` in tests/test_assessment_corpora.py:74", "shortDescription": {"text": "Legacy-named symbol `recorded_v1` in tests/test_assessment_corpora.py:74"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f3f2396bd8a0ba17", "name": "Legacy-named symbol `test_runs_on_withers_corpus_copy` in tests/test_proposition_pipeline.py:1326", "shortDescription": {"text": "Legacy-named symbol `test_runs_on_withers_corpus_copy` in tests/test_proposition_pipeline.py:1326"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d98cad994cd69756", "name": "Commented-code block (16 lines) in tests/test_refactor_corpus.py:124", "shortDescription": {"text": "Commented-code block (16 lines) in tests/test_refactor_corpus.py:124"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-742b7f2c45912f12", "name": "Commented-code block (5 lines) in tests/test_false_negatives.py:91", "shortDescription": {"text": "Commented-code block (5 lines) in tests/test_false_negatives.py:91"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e7caef30784f4ace", "name": "Commented-code block (12 lines) in tests/build_withers_corpus.py:36", "shortDescription": {"text": "Commented-code block (12 lines) in tests/build_withers_corpus.py:36"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0ba900cbaeba63d8", "name": "Commented-code block (5 lines) in tests/test_cl_api_issues.py:92", "shortDescription": {"text": "Commented-code block (5 lines) in tests/test_cl_api_issues.py:92"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-52ec92219811671e", "name": "Legacy-named symbol `counter_old` in scripts/recalibrate_against_qc.py:70", "shortDescription": {"text": "Legacy-named symbol `counter_old` in scripts/recalibrate_against_qc.py:70"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-43c3a2ef6fea7947", "name": "Legacy-named symbol `docket_only_v2` in scratch/find_docket_only_v2.py:114", "shortDescription": {"text": "Legacy-named symbol `docket_only_v2` in scratch/find_docket_only_v2.py:114"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e26f5e023e586ccc", "name": "Network/subprocess call without timeout or try/except \u2014 scratch/casedev/batch_verify_50.py:49", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scratch/casedev/batch_verify_50.py:49"}, "fullDescription": {"text": "`requests.post(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea2ac003ccf9c412", "name": "Commented-code block (7 lines) in web/app.py:39", "shortDescription": {"text": "Commented-code block (7 lines) in web/app.py:39"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9e7cecec25285a6a", "name": "Commented-code block (5 lines) in .claude/skills/pdf-processing-anthropic/scripts/extract_form_field_info.py:56", "shortDescription": {"text": "Commented-code block (5 lines) in .claude/skills/pdf-processing-anthropic/scripts/extract_form_field_info.py:56"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8ff8097e79f54cc5", "name": "Legacy-named symbol `assess_v1` in tools/ab_test_runner.py:10", "shortDescription": {"text": "Legacy-named symbol `assess_v1` in tools/ab_test_runner.py:10"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-41928ff65812452b", "name": "Legacy-named symbol `record_assess_v2` in tools/record_assess_v2.py:14", "shortDescription": {"text": "Legacy-named symbol `record_assess_v2` in tools/record_assess_v2.py:14"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-14ae01ffd40b386c", "name": "Commented-code block (7 lines) in src/citation_verifier/report_template.py:11", "shortDescription": {"text": "Commented-code block (7 lines) in src/citation_verifier/report_template.py:11"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8da86d1e377cff2e", "name": "Commented-code block (5 lines) in src/citation_verifier/parser.py:44", "shortDescription": {"text": "Commented-code block (5 lines) in src/citation_verifier/parser.py:44"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2039a08ca361ef7c", "name": "Commented-code block (5 lines) in src/citation_verifier/resolution_path.py:119", "shortDescription": {"text": "Commented-code block (5 lines) in src/citation_verifier/resolution_path.py:119"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7adcedf7f30994de", "name": "Legacy-named symbol `parts_legacy` in src/citation_verifier/proposition_pipeline.py:2202", "shortDescription": {"text": "Legacy-named symbol `parts_legacy` in src/citation_verifier/proposition_pipeline.py:2202"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8198a6860f65d201", "name": "Commented-code block (7 lines) in src/citation_verifier/proposition_pipeline.py:243", "shortDescription": {"text": "Commented-code block (7 lines) in src/citation_verifier/proposition_pipeline.py:243"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7310c44d59b10e31", "name": "Commented-code block (5 lines) in src/citation_verifier/verifier.py:54", "shortDescription": {"text": "Commented-code block (5 lines) in src/citation_verifier/verifier.py:54"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-33e9f6c683a30830", "name": "Commented-code block (5 lines) in src/citation_verifier/executor.py:263", "shortDescription": {"text": "Commented-code block (5 lines) in src/citation_verifier/executor.py:263"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b154192dccf31294", "name": "Commented-code block (6 lines) in src/citation_verifier/models.py:23", "shortDescription": {"text": "Commented-code block (6 lines) in src/citation_verifier/models.py:23"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-07f6ef2aee83f609", "name": "Commented-code block (5 lines) in src/citation_verifier/scoring.py:158", "shortDescription": {"text": "Commented-code block (5 lines) in src/citation_verifier/scoring.py:158"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9b90074e0805c1c7", "name": "Commented-code block (14 lines) in src/citation_verifier/__main__.py:255", "shortDescription": {"text": "Commented-code block (14 lines) in src/citation_verifier/__main__.py:255"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4d7b67ed60a40aba", "name": "Commented-code block (7 lines) in src/citation_verifier/state_reporter_map.py:359", "shortDescription": {"text": "Commented-code block (7 lines) in src/citation_verifier/state_reporter_map.py:359"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nweb/app.py:event_generator, web/app.py:event_generator\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49c98f7cedd9c977", "name": "Near-duplicate function bodies in 4 places", "shortDescription": {"text": "Near-duplicate function bodies in 4 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nsrc/citation_verifier/client.py:search_opinions, src/citation_verifier/client.py:search_recap, src/citation_verifier/client.py:search_opinions, src/citation_verifier/client.py:search_recap\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-76bfd60533cf4a79", "name": "FastAPI POST `verify` without auth dependency \u2014 web/app.py:363", "shortDescription": {"text": "FastAPI POST `verify` without auth dependency \u2014 web/app.py:363"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-085dbbb49cd1d257", "name": "FastAPI POST `download_pdfs` without auth dependency \u2014 web/app.py:469", "shortDescription": {"text": "FastAPI POST `download_pdfs` without auth dependency \u2014 web/app.py:469"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-15bf6383329e0b5a", "name": "FastAPI POST `download_texts` without auth dependency \u2014 web/app.py:590", "shortDescription": {"text": "FastAPI POST `download_texts` without auth dependency \u2014 web/app.py:590"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f87c64d49d9b02b3", "name": "FastAPI POST `download_htmls` without auth dependency \u2014 web/app.py:706", "shortDescription": {"text": "FastAPI POST `download_htmls` without auth dependency \u2014 web/app.py:706"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-33b237fbfc1f42ff", "name": "FastAPI POST `flag_for_flp` without auth dependency \u2014 web/app.py:875", "shortDescription": {"text": "FastAPI POST `flag_for_flp` without auth dependency \u2014 web/app.py:875"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-31a74a31aaeb20fc", "name": "FastAPI POST `qc_save` without auth dependency \u2014 web/app.py:1001", "shortDescription": {"text": "FastAPI POST `qc_save` without auth dependency \u2014 web/app.py:1001"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-55c39a690b88057a", "name": "FastAPI POST `qc_run_batch` without auth dependency \u2014 web/app.py:1316", "shortDescription": {"text": "FastAPI POST `qc_run_batch` without auth dependency \u2014 web/app.py:1316"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`web/app.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-718c7ce1b146296e", "name": "Unused endpoint: GET /get", "shortDescription": {"text": "Unused endpoint: GET /get"}, "fullDescription": {"text": "`web/app.py` declares `GET /get` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fa7bbe540d3e196d", "name": "Unused endpoint: GET /debug", "shortDescription": {"text": "Unused endpoint: GET /debug"}, "fullDescription": {"text": "`web/app.py` declares `GET /debug` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4756b4c4da7d2088", "name": "Unused endpoint: GET /api/health", "shortDescription": {"text": "Unused endpoint: GET /api/health"}, "fullDescription": {"text": "`web/app.py` declares `GET /api/health` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-744b590128b8791e", "name": "Unused endpoint: POST /api/verify", "shortDescription": {"text": "Unused endpoint: POST /api/verify"}, "fullDescription": {"text": "`web/app.py` declares `POST /api/verify` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2bcaa7b2c2a04f16", "name": "Unused endpoint: POST /api/download-pdfs", "shortDescription": {"text": "Unused endpoint: POST /api/download-pdfs"}, "fullDescription": {"text": "`web/app.py` declares `POST /api/download-pdfs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-69cb8f769494baf3", "name": "Unused endpoint: POST /api/download-texts", "shortDescription": {"text": "Unused endpoint: POST /api/download-texts"}, "fullDescription": {"text": "`web/app.py` declares `POST /api/download-texts` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-709b51214494d4b9", "name": "Unused endpoint: POST /api/download-htmls", "shortDescription": {"text": "Unused endpoint: POST /api/download-htmls"}, "fullDescription": {"text": "`web/app.py` declares `POST /api/download-htmls` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-48db348f3f2c689a", "name": "Unused endpoint: POST /api/flag-for-flp", "shortDescription": {"text": "Unused endpoint: POST /api/flag-for-flp"}, "fullDescription": {"text": "`web/app.py` declares `POST /api/flag-for-flp` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1d03d7b1687dae8b", "name": "Unused endpoint: GET /qc", "shortDescription": {"text": "Unused endpoint: GET /qc"}, "fullDescription": {"text": "`web/app.py` declares `GET /qc` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-075f21e24f7e3d28", "name": "Unused endpoint: GET /api/qc/runs", "shortDescription": {"text": "Unused endpoint: GET /api/qc/runs"}, "fullDescription": {"text": "`web/app.py` declares `GET /api/qc/runs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-07f1d56352b56271", "name": "Unused endpoint: GET /api/qc/run/{filename}", "shortDescription": {"text": "Unused endpoint: GET /api/qc/run/{filename}"}, "fullDescription": {"text": "`web/app.py` declares `GET /api/qc/run/{filename}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f9f45fed87b8283b", "name": "Unused endpoint: POST /api/qc/save", "shortDescription": {"text": "Unused endpoint: POST /api/qc/save"}, "fullDescription": {"text": "`web/app.py` declares `POST /api/qc/save` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7223f74d650fb52e", "name": "Unused endpoint: GET /api/qc/opinion-text", "shortDescription": {"text": "Unused endpoint: GET /api/qc/opinion-text"}, "fullDescription": {"text": "`web/app.py` declares `GET /api/qc/opinion-text` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ecfce79b0f28608e", "name": "Unused endpoint: POST /api/qc/run-batch", "shortDescription": {"text": "Unused endpoint: POST /api/qc/run-batch"}, "fullDescription": {"text": "`web/app.py` declares `POST /api/qc/run-batch` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/18251"}, "properties": {"repository": "rlfordon/citation-verifier", "repoUrl": "https://github.com/rlfordon/citation-verifier", "branch": "main"}, "results": [{"ruleId": "scanner-212708e1c0cff933", "level": "note", "message": {"text": "Possibly dead Python function: patched_get_inherited"}, "properties": {"repobilityId": "8c99afa3f6ae758e", "scanner": "scanner-primary", "fingerprint": "212708e1c0cff933", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/pdf-processing-anthropic/scripts/fill_fillable_fields.py:96"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-84c3ebc1c26207ce", "level": "note", "message": {"text": "Possibly dead Python function: sort_key"}, "properties": {"repobilityId": "ac2a4181eae38738", "scanner": "scanner-primary", "fingerprint": "84c3ebc1c26207ce", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/pdf-processing-anthropic/scripts/extract_form_field_info.py:126"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-164f03045496f897", "level": "note", "message": {"text": "Possibly dead Python function: remove_trailing_contamination"}, "properties": {"repobilityId": "ef5f643c3b58e47b", "scanner": "scanner-primary", "fingerprint": "164f03045496f897", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/citation_verifier/text_cleaner.py:111"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c3de86bbfc499ef0", "level": "note", "message": {"text": "Possibly dead Python function: is_regional_reporter"}, "properties": {"repobilityId": "9e802026f591e3b8", "scanner": "scanner-primary", "fingerprint": "c3de86bbfc499ef0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/citation_verifier/state_reporter_map.py:602"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-8f8464cb27ae076e", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web/static/index.html:430"}, "properties": {"repobilityId": "9058fa0a7fd59bc3", "scanner": "scanner-primary", "fingerprint": "8f8464cb27ae076e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/static/index.html"}, "region": {"startLine": 430}}}]}, {"ruleId": "scanner-e39e871eb7b8c091", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web/static/get.html:459"}, "properties": {"repobilityId": "00a129fb2101be89", "scanner": "scanner-primary", "fingerprint": "e39e871eb7b8c091", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/static/get.html"}, "region": {"startLine": 459}}}]}, {"ruleId": "scanner-2ba729965c4509c0", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in web/static/get.html:410"}, "properties": {"repobilityId": "5e216eef149d8b42", "scanner": "scanner-primary", "fingerprint": "2ba729965c4509c0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/static/get.html"}, "region": {"startLine": 410}}}]}, {"ruleId": "scanner-aeacdea4a1554aa5", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web/static/qc.html:520"}, "properties": {"repobilityId": "62c7c20fdd652d9b", "scanner": "scanner-primary", "fingerprint": "aeacdea4a1554aa5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/static/qc.html"}, "region": {"startLine": 520}}}]}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-daadbfc3f1c1caad", "level": "note", "message": {"text": "Very large file: tests/test_verifier.py (3901 lines)"}, "properties": {"repobilityId": "f5cbfc18e5943d06", "scanner": "scanner-primary", "fingerprint": "daadbfc3f1c1caad", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-1b4b23bd5455627b", "level": "note", "message": {"text": "Very large file: tests/test_async_verifier.py (2184 lines)"}, "properties": {"repobilityId": "36f99b1ccc36ee70", "scanner": "scanner-primary", "fingerprint": "1b4b23bd5455627b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-0ed4360e7c643df9", "level": "note", "message": {"text": "Very large file: tests/test_proposition_pipeline.py (2013 lines)"}, "properties": {"repobilityId": "03d5436c5d18ae76", "scanner": "scanner-primary", "fingerprint": "0ed4360e7c643df9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6636e790283e1c5b", "level": "note", "message": {"text": "Very large file: web/app.py (1549 lines)"}, "properties": {"repobilityId": "72808f5ad80d96b7", "scanner": "scanner-primary", "fingerprint": "6636e790283e1c5b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-13750c1d026fd322", "level": "note", "message": {"text": "Very large file: src/citation_verifier/proposition_pipeline.py (2259 lines)"}, "properties": {"repobilityId": "2e78222b8b614911", "scanner": "scanner-primary", "fingerprint": "13750c1d026fd322", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-fd8b459ac1fdc117", "level": "note", "message": {"text": "Very large file: src/citation_verifier/verifier.py (3639 lines)"}, "properties": {"repobilityId": "e783e574fb4d5079", "scanner": "scanner-primary", "fingerprint": "fd8b459ac1fdc117", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "93677b404030696e", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "9998c186d7c49e2e", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "b08ce39b954e59a2", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "42917bc08b1bc5eb", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "3ed6af66e837b42d", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-122f91b7f2906dc4", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "properties": {"repobilityId": "a2967269048b6a9d", "scanner": "scanner-primary", "fingerprint": "122f91b7f2906dc4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/settings.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2dcb3af2fef049cf", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/pdf-processing-anthropic/references/REFERENCE.md"}, "properties": {"repobilityId": "8eadb5535e20301c", "scanner": "scanner-primary", "fingerprint": "2dcb3af2fef049cf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/pdf-processing-anthropic/references/REFERENCE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-84114c9f11e46c5a", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/build_assessment_corpora.py:105"}, "properties": {"repobilityId": "924ed8aa4d38996f", "scanner": "scanner-primary", "fingerprint": "84114c9f11e46c5a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-628718d32bc2d57e", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/test_verifier.py:1160"}, "properties": {"repobilityId": "ddbdb8045d7b342a", "scanner": "scanner-primary", "fingerprint": "628718d32bc2d57e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-83ab5f709d411a0e", "level": "none", "message": {"text": "Commented-code block (8 lines) in tests/verify_from_csv.py:427"}, "properties": {"repobilityId": "ff78a7e4634f49f9", "scanner": "scanner-primary", "fingerprint": "83ab5f709d411a0e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7949fd5d58a854ef", "level": "note", "message": {"text": "Legacy-named symbol `test_hint_config_rejected_for_v1` in tests/test_ab_runner.py:50"}, "properties": {"repobilityId": "185b8052c4cced29", "scanner": "scanner-primary", "fingerprint": "7949fd5d58a854ef", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-46e7e177a373612b", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/test_cli_verify_json.py:48"}, "properties": {"repobilityId": "736ff9d35ffbff90", "scanner": "scanner-primary", "fingerprint": "46e7e177a373612b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8bf1b46113e48297", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/build_charlotin_corpus.py:59"}, "properties": {"repobilityId": "d2bd1fda29f823d3", "scanner": "scanner-primary", "fingerprint": "8bf1b46113e48297", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-00aabc0631572038", "level": "note", "message": {"text": "Legacy-named symbol `test_single_object_fanout_unchanged_for_v1` in tests/test_executor.py:383"}, "properties": {"repobilityId": "abcd57164810ebfd", "scanner": "scanner-primary", "fingerprint": "00aabc0631572038", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-2a7b8dbfd1e73df0", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/test_false_positives.py:35"}, "properties": {"repobilityId": "c517e0841d6725cc", "scanner": "scanner-primary", "fingerprint": "2a7b8dbfd1e73df0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-02c4bb00147a9ad9", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/mock_spec_harness.py:31"}, "properties": {"repobilityId": "0ac80e688a2e554c", "scanner": "scanner-primary", "fingerprint": "02c4bb00147a9ad9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0fffd10854b938ca", "level": "note", "message": {"text": "Legacy-named symbol `test_withers_v2` in tests/test_assessment_regression.py:105"}, "properties": {"repobilityId": "5d9f3589031ff20b", "scanner": "scanner-primary", "fingerprint": "0fffd10854b938ca", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-973de2a9eafe7269", "level": "note", "message": {"text": "Legacy-named symbol `recorded_v1` in tests/test_assessment_corpora.py:74"}, "properties": {"repobilityId": "76c9d3b24711cb68", "scanner": "scanner-primary", "fingerprint": "973de2a9eafe7269", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-f3f2396bd8a0ba17", "level": "note", "message": {"text": "Legacy-named symbol `test_runs_on_withers_corpus_copy` in tests/test_proposition_pipeline.py:1326"}, "properties": {"repobilityId": "a093994d15a7b3c4", "scanner": "scanner-primary", "fingerprint": "f3f2396bd8a0ba17", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-d98cad994cd69756", "level": "none", "message": {"text": "Commented-code block (16 lines) in tests/test_refactor_corpus.py:124"}, "properties": {"repobilityId": "f87e66aaad96f75a", "scanner": "scanner-primary", "fingerprint": "d98cad994cd69756", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-742b7f2c45912f12", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/test_false_negatives.py:91"}, "properties": {"repobilityId": "4492e2be84b18bef", "scanner": "scanner-primary", "fingerprint": "742b7f2c45912f12", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e7caef30784f4ace", "level": "none", "message": {"text": "Commented-code block (12 lines) in tests/build_withers_corpus.py:36"}, "properties": {"repobilityId": "6cd4fdcaac9ed7b1", "scanner": "scanner-primary", "fingerprint": "e7caef30784f4ace", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0ba900cbaeba63d8", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/test_cl_api_issues.py:92"}, "properties": {"repobilityId": "0fe66d407fdcade8", "scanner": "scanner-primary", "fingerprint": "0ba900cbaeba63d8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-52ec92219811671e", "level": "note", "message": {"text": "Legacy-named symbol `counter_old` in scripts/recalibrate_against_qc.py:70"}, "properties": {"repobilityId": "8c4e1e6373a4040f", "scanner": "scanner-primary", "fingerprint": "52ec92219811671e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-43c3a2ef6fea7947", "level": "note", "message": {"text": "Legacy-named symbol `docket_only_v2` in scratch/find_docket_only_v2.py:114"}, "properties": {"repobilityId": "22bab04da2bc7afd", "scanner": "scanner-primary", "fingerprint": "43c3a2ef6fea7947", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-e26f5e023e586ccc", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scratch/casedev/batch_verify_50.py:49"}, "properties": {"repobilityId": "6f44ed661c7db5bf", "scanner": "scanner-primary", "fingerprint": "e26f5e023e586ccc", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-ea2ac003ccf9c412", "level": "none", "message": {"text": "Commented-code block (7 lines) in web/app.py:39"}, "properties": {"repobilityId": "20aa3505d0e60d6d", "scanner": "scanner-primary", "fingerprint": "ea2ac003ccf9c412", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9e7cecec25285a6a", "level": "none", "message": {"text": "Commented-code block (5 lines) in .claude/skills/pdf-processing-anthropic/scripts/extract_form_field_info.py:56"}, "properties": {"repobilityId": "1eca8c41bcd574c0", "scanner": "scanner-primary", "fingerprint": "9e7cecec25285a6a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8ff8097e79f54cc5", "level": "note", "message": {"text": "Legacy-named symbol `assess_v1` in tools/ab_test_runner.py:10"}, "properties": {"repobilityId": "421b8f574d459a91", "scanner": "scanner-primary", "fingerprint": "8ff8097e79f54cc5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-41928ff65812452b", "level": "note", "message": {"text": "Legacy-named symbol `record_assess_v2` in tools/record_assess_v2.py:14"}, "properties": {"repobilityId": "c907989b9b2566bb", "scanner": "scanner-primary", "fingerprint": "41928ff65812452b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-14ae01ffd40b386c", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/citation_verifier/report_template.py:11"}, "properties": {"repobilityId": "0a3b9333675d2b48", "scanner": "scanner-primary", "fingerprint": "14ae01ffd40b386c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8da86d1e377cff2e", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/citation_verifier/parser.py:44"}, "properties": {"repobilityId": "d196a6a908f67239", "scanner": "scanner-primary", "fingerprint": "8da86d1e377cff2e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2039a08ca361ef7c", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/citation_verifier/resolution_path.py:119"}, "properties": {"repobilityId": "db864008ac580965", "scanner": "scanner-primary", "fingerprint": "2039a08ca361ef7c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7adcedf7f30994de", "level": "note", "message": {"text": "Legacy-named symbol `parts_legacy` in src/citation_verifier/proposition_pipeline.py:2202"}, "properties": {"repobilityId": "8d05501cadac9736", "scanner": "scanner-primary", "fingerprint": "7adcedf7f30994de", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-8198a6860f65d201", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/citation_verifier/proposition_pipeline.py:243"}, "properties": {"repobilityId": "7d7ab8f76882e657", "scanner": "scanner-primary", "fingerprint": "8198a6860f65d201", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7310c44d59b10e31", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/citation_verifier/verifier.py:54"}, "properties": {"repobilityId": "7395b749eab8bdb7", "scanner": "scanner-primary", "fingerprint": "7310c44d59b10e31", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-33e9f6c683a30830", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/citation_verifier/executor.py:263"}, "properties": {"repobilityId": "52305c35630921fe", "scanner": "scanner-primary", "fingerprint": "33e9f6c683a30830", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b154192dccf31294", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/citation_verifier/models.py:23"}, "properties": {"repobilityId": "352f6d7f2bbf1ec4", "scanner": "scanner-primary", "fingerprint": "b154192dccf31294", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-07f6ef2aee83f609", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/citation_verifier/scoring.py:158"}, "properties": {"repobilityId": "76126049421d56df", "scanner": "scanner-primary", "fingerprint": "07f6ef2aee83f609", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9b90074e0805c1c7", "level": "none", "message": {"text": "Commented-code block (14 lines) in src/citation_verifier/__main__.py:255"}, "properties": {"repobilityId": "bc571aed9545e882", "scanner": "scanner-primary", "fingerprint": "9b90074e0805c1c7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4d7b67ed60a40aba", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/citation_verifier/state_reporter_map.py:359"}, "properties": {"repobilityId": "44c3c5a28609aa53", "scanner": "scanner-primary", "fingerprint": "4d7b67ed60a40aba", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "40060d82cbd5d210", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "faa1b67b0c4d6a02", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "df5b8c1b13c0ea27", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "874cee69a6933694", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "6637dd9a9ad115ed", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "700eb7a09986a929", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "847cedc4a3a52b5a", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "85511d420b3000a3", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "a0a192f1c0a7a285", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "910fa2650def9e15", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "534c6acff20eeac6", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "87bfb0b80beff03a", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-76bfd60533cf4a79", "level": "error", "message": {"text": "FastAPI POST `verify` without auth dependency \u2014 web/app.py:363"}, "properties": {"repobilityId": "e0318ec28d78c2bd", "scanner": "scanner-primary", "fingerprint": "76bfd60533cf4a79", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/app.py"}, "region": {"startLine": 363}}}]}, {"ruleId": "scanner-085dbbb49cd1d257", "level": "error", "message": {"text": "FastAPI POST `download_pdfs` without auth dependency \u2014 web/app.py:469"}, "properties": {"repobilityId": "b337beb26c051860", "scanner": "scanner-primary", "fingerprint": "085dbbb49cd1d257", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/app.py"}, "region": {"startLine": 469}}}]}, {"ruleId": "scanner-15bf6383329e0b5a", "level": "error", "message": {"text": "FastAPI POST `download_texts` without auth dependency \u2014 web/app.py:590"}, "properties": {"repobilityId": "8fa0ebcf82400ada", "scanner": "scanner-primary", "fingerprint": "15bf6383329e0b5a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/app.py"}, "region": {"startLine": 590}}}]}, {"ruleId": "scanner-f87c64d49d9b02b3", "level": "error", "message": {"text": "FastAPI POST `download_htmls` without auth dependency \u2014 web/app.py:706"}, "properties": {"repobilityId": "fbd317831a17dbb3", "scanner": "scanner-primary", "fingerprint": "f87c64d49d9b02b3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/app.py"}, "region": {"startLine": 706}}}]}, {"ruleId": "scanner-33b237fbfc1f42ff", "level": "error", "message": {"text": "FastAPI POST `flag_for_flp` without auth dependency \u2014 web/app.py:875"}, "properties": {"repobilityId": "899145b823b58da3", "scanner": "scanner-primary", "fingerprint": "33b237fbfc1f42ff", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/app.py"}, "region": {"startLine": 875}}}]}, {"ruleId": "scanner-31a74a31aaeb20fc", "level": "error", "message": {"text": "FastAPI POST `qc_save` without auth dependency \u2014 web/app.py:1001"}, "properties": {"repobilityId": "0115ce71ac5b2330", "scanner": "scanner-primary", "fingerprint": "31a74a31aaeb20fc", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/app.py"}, "region": {"startLine": 1001}}}]}, {"ruleId": "scanner-55c39a690b88057a", "level": "error", "message": {"text": "FastAPI POST `qc_run_batch` without auth dependency \u2014 web/app.py:1316"}, "properties": {"repobilityId": "4fe466ba7be7763e", "scanner": "scanner-primary", "fingerprint": "55c39a690b88057a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/app.py"}, "region": {"startLine": 1316}}}]}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "f0c32eb2e07cab14", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-718c7ce1b146296e", "level": "note", "message": {"text": "Unused endpoint: GET /get"}, "properties": {"repobilityId": "237e17f59c993ae2", "scanner": "scanner-primary", "fingerprint": "718c7ce1b146296e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fa7bbe540d3e196d", "level": "note", "message": {"text": "Unused endpoint: GET /debug"}, "properties": {"repobilityId": "48710096f55a9487", "scanner": "scanner-primary", "fingerprint": "fa7bbe540d3e196d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4756b4c4da7d2088", "level": "note", "message": {"text": "Unused endpoint: GET /api/health"}, "properties": {"repobilityId": "e6a8d0f011a74594", "scanner": "scanner-primary", "fingerprint": "4756b4c4da7d2088", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-744b590128b8791e", "level": "note", "message": {"text": "Unused endpoint: POST /api/verify"}, "properties": {"repobilityId": "93dd13cf4bb83814", "scanner": "scanner-primary", "fingerprint": "744b590128b8791e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2bcaa7b2c2a04f16", "level": "note", "message": {"text": "Unused endpoint: POST /api/download-pdfs"}, "properties": {"repobilityId": "5ce7a5ce3b66920c", "scanner": "scanner-primary", "fingerprint": "2bcaa7b2c2a04f16", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-69cb8f769494baf3", "level": "note", "message": {"text": "Unused endpoint: POST /api/download-texts"}, "properties": {"repobilityId": "f6925ea0d8ff500c", "scanner": "scanner-primary", "fingerprint": "69cb8f769494baf3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-709b51214494d4b9", "level": "note", "message": {"text": "Unused endpoint: POST /api/download-htmls"}, "properties": {"repobilityId": "eebaafdda1158a81", "scanner": "scanner-primary", "fingerprint": "709b51214494d4b9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-48db348f3f2c689a", "level": "note", "message": {"text": "Unused endpoint: POST /api/flag-for-flp"}, "properties": {"repobilityId": "dfbc70c8d82ab785", "scanner": "scanner-primary", "fingerprint": "48db348f3f2c689a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1d03d7b1687dae8b", "level": "note", "message": {"text": "Unused endpoint: GET /qc"}, "properties": {"repobilityId": "f498671b738adb7c", "scanner": "scanner-primary", "fingerprint": "1d03d7b1687dae8b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-075f21e24f7e3d28", "level": "note", "message": {"text": "Unused endpoint: GET /api/qc/runs"}, "properties": {"repobilityId": "7a31b18278b2cd2c", "scanner": "scanner-primary", "fingerprint": "075f21e24f7e3d28", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-07f1d56352b56271", "level": "note", "message": {"text": "Unused endpoint: GET /api/qc/run/{filename}"}, "properties": {"repobilityId": "681ae136a91d1b64", "scanner": "scanner-primary", "fingerprint": "07f1d56352b56271", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f9f45fed87b8283b", "level": "note", "message": {"text": "Unused endpoint: POST /api/qc/save"}, "properties": {"repobilityId": "6085518036fddcb0", "scanner": "scanner-primary", "fingerprint": "f9f45fed87b8283b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7223f74d650fb52e", "level": "note", "message": {"text": "Unused endpoint: GET /api/qc/opinion-text"}, "properties": {"repobilityId": "e4670e27d5e3b7de", "scanner": "scanner-primary", "fingerprint": "7223f74d650fb52e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ecfce79b0f28608e", "level": "note", "message": {"text": "Unused endpoint: POST /api/qc/run-batch"}, "properties": {"repobilityId": "72d3fa58253e7a0e", "scanner": "scanner-primary", "fingerprint": "ecfce79b0f28608e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}