{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-5811a4f521070bb7", "name": "Possibly dead Python function: readonly_guard", "shortDescription": {"text": "Possibly dead Python function: readonly_guard"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c68a391b3643c192", "name": "Possibly dead Python function: capture_failure", "shortDescription": {"text": "Possibly dead Python function: capture_failure"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-161f712f200b36d7", "name": "Possibly dead Python function: do_POST", "shortDescription": {"text": "Possibly dead Python function: do_POST"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9774c0890d73f0c5", "name": "Possibly dead Python function: do_GET", "shortDescription": {"text": "Possibly dead Python function: do_GET"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eb35fb0d5a02251a", "name": "Possibly dead Python function: log_message", "shortDescription": {"text": "Possibly dead Python function: log_message"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b120bc5b990b1f0e", "name": "Possibly dead Python function: do_POST", "shortDescription": {"text": "Possibly dead Python function: do_POST"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5279b917aad3351a", "name": "Possibly dead Python function: do_GET", "shortDescription": {"text": "Possibly dead Python function: do_GET"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72fc79393a57cafc", "name": "Possibly dead Python function: log_message", "shortDescription": {"text": "Possibly dead Python function: log_message"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-acfc51ae4e47d581", "name": "Possibly dead Python function: cart_total", "shortDescription": {"text": "Possibly dead Python function: cart_total"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-46d6cde96c2aeb4c", "name": "Possibly dead Python function: run_daily_job", "shortDescription": {"text": "Possibly dead Python function: run_daily_job"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7f1a7c0594794452", "name": "Possibly dead Python function: filter", "shortDescription": {"text": "Possibly dead Python function: filter"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2aec7940f9a4d97b", "name": "Possibly dead Python function: cmd_ask", "shortDescription": {"text": "Possibly dead Python function: cmd_ask"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6b313b9010447876", "name": "Possibly dead Python function: cmd_start", "shortDescription": {"text": "Possibly dead Python function: cmd_start"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2149dbf818d68abc", "name": "Possibly dead Python function: cmd_health", "shortDescription": {"text": "Possibly dead Python function: cmd_health"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5a4afaa1478f7742", "name": "Possibly dead Python function: cmd_optout", "shortDescription": {"text": "Possibly dead Python function: cmd_optout"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d7ef0689b523e97", "name": "Possibly dead Python function: cmd_optin", "shortDescription": {"text": "Possibly dead Python function: cmd_optin"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0e0970e9d4600d56", "name": "Possibly dead Python function: cmd_post_retro", "shortDescription": {"text": "Possibly dead Python function: cmd_post_retro"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f64e7a5f838a3e28", "name": "Possibly dead Python function: cmd_skip_retro", "shortDescription": {"text": "Possibly dead Python function: cmd_skip_retro"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b98ba7175a9c7202", "name": "Possibly dead Python function: cmd_quiz", "shortDescription": {"text": "Possibly dead Python function: cmd_quiz"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4fb5c117a1195e7f", "name": "Possibly dead Python function: cmd_poll", "shortDescription": {"text": "Possibly dead Python function: cmd_poll"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-050660c57dd43eb5", "name": "Possibly dead Python function: cmd_preview_retro", "shortDescription": {"text": "Possibly dead Python function: cmd_preview_retro"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d63724ccd360e53", "name": "Possibly dead Python function: passive_log", "shortDescription": {"text": "Possibly dead Python function: passive_log"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-44ba2e9b5dc924f5", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c842d013333fc296", "name": "Very large file: cohort-agent/telegram_bot.py (1293 lines)", "shortDescription": {"text": "Very large file: cohort-agent/telegram_bot.py (1293 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 23 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-981373369ad4633a", "name": "Node manifest has dependencies but no lockfile: lesson2/starter-hook-template/codex-sdk-nodejs/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: lesson2/starter-hook-template/codex-sdk-nodejs/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 125 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci, tests, lockfile. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, ci, tests, lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8bd3191ad8ed15eb", "name": "Agent authority lacks a verifier contract: lesson2/starter-hook-template/agent-sdk-python/.claude/skills/my-task/SKILL.m", "shortDescription": {"text": "Agent authority lacks a verifier contract: lesson2/starter-hook-template/agent-sdk-python/.claude/skills/my-task/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-75e553123644226a", "name": "Agent authority lacks a verifier contract: lesson2/starter-hook-template/codex-sdk-nodejs/.codex/hooks.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: lesson2/starter-hook-template/codex-sdk-nodejs/.codex/hooks.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-43464e5d17d71790", "name": "Agent authority lacks a verifier contract: lesson2/starter-hook-template/codex-sdk-nodejs/.codex/skills/my-task/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: lesson2/starter-hook-template/codex-sdk-nodejs/.codex/skills/my-task/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-282cde20f610d52f", "name": "Agent authority lacks a verifier contract: lesson4/reference-colleague/CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: lesson4/reference-colleague/CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e1ad0d64a5810b90", "name": "Agent authority lacks a verifier contract: lesson4/reference-colleague/skills/review-pr/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: lesson4/reference-colleague/skills/review-pr/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-14e384d6aedf4516", "name": "Agent authority lacks a verifier contract: lesson4/reference-colleague/.claude/settings.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: lesson4/reference-colleague/.claude/settings.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-25e34770defa7e9a", "name": "Commented-code block (6 lines) in cohort-agent/digest.py:378", "shortDescription": {"text": "Commented-code block (6 lines) in cohort-agent/digest.py:378"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7c3d44e5764c4467", "name": "Commented-code block (7 lines) in cohort-agent/telegram_bot.py:1259", "shortDescription": {"text": "Commented-code block (7 lines) in cohort-agent/telegram_bot.py:1259"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b0b5e7cb1208a7cd", "name": "13 env vars used in code but missing from .env.example", "shortDescription": {"text": "13 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `CAPTURE_CWD`, `CAPTURE_MODE`, `CLAUDE_RULES_DIR`, `LANGFUSE_HOST`, `LANGFUSE_PUBLIC_KEY`, `ONSA_MCP_ENTRY`, `OWNER_TELEGRAM_USER_ID`, `PORT` + 5 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nlesson3/under-the-hood/tap.py:do_POST, lesson3/under-the-hood/wire-peek/tap.py:do_POST\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/24499"}, "properties": {"repository": "BayramAnnakov/edu-ai-product-engineer-s4", "repoUrl": "https://github.com/BayramAnnakov/edu-ai-product-engineer-s4", "branch": "main"}, "results": [{"ruleId": "scanner-5811a4f521070bb7", "level": "note", "message": {"text": "Possibly dead Python function: readonly_guard"}, "properties": {"repobilityId": "5a85c2d8c7ebe5a0", "scanner": "scanner-primary", "fingerprint": "5811a4f521070bb7", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lesson2/starter-hook-template/agent-sdk-python/colleague.py:58"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c68a391b3643c192", "level": "note", "message": {"text": "Possibly dead Python function: capture_failure"}, "properties": {"repobilityId": "6b73447db09473cf", "scanner": "scanner-primary", "fingerprint": "c68a391b3643c192", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lesson2/starter-hook-template/agent-sdk-python/colleague.py:84"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-161f712f200b36d7", "level": "note", "message": {"text": "Possibly dead Python function: do_POST"}, "properties": {"repobilityId": "53357410ca9379a9", "scanner": "scanner-primary", "fingerprint": "161f712f200b36d7", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lesson3/under-the-hood/tap.py:88"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9774c0890d73f0c5", "level": "note", "message": {"text": "Possibly dead Python function: do_GET"}, "properties": {"repobilityId": "2d943bb45e4f13bd", "scanner": "scanner-primary", "fingerprint": "9774c0890d73f0c5", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lesson3/under-the-hood/tap.py:89"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-eb35fb0d5a02251a", "level": "note", "message": {"text": "Possibly dead Python function: log_message"}, "properties": {"repobilityId": "965f3150b4af5b2e", "scanner": "scanner-primary", "fingerprint": "eb35fb0d5a02251a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lesson3/under-the-hood/tap.py:90"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b120bc5b990b1f0e", "level": "note", "message": {"text": "Possibly dead Python function: do_POST"}, "properties": {"repobilityId": "53357410ca9379a9", "scanner": "scanner-primary", "fingerprint": "b120bc5b990b1f0e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lesson3/under-the-hood/wire-peek/tap.py:88"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5279b917aad3351a", "level": "note", "message": {"text": "Possibly dead Python function: do_GET"}, "properties": {"repobilityId": "2d943bb45e4f13bd", "scanner": "scanner-primary", "fingerprint": "5279b917aad3351a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lesson3/under-the-hood/wire-peek/tap.py:89"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-72fc79393a57cafc", "level": "note", "message": {"text": "Possibly dead Python function: log_message"}, "properties": {"repobilityId": "965f3150b4af5b2e", "scanner": "scanner-primary", "fingerprint": "72fc79393a57cafc", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lesson3/under-the-hood/wire-peek/tap.py:90"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-acfc51ae4e47d581", "level": "note", "message": {"text": "Possibly dead Python function: cart_total"}, "properties": {"repobilityId": "2ef341f2fac4a53f", "scanner": "scanner-primary", "fingerprint": "acfc51ae4e47d581", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lesson4/reference-colleague/sample-repo/billing.py:19"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-46d6cde96c2aeb4c", "level": "note", "message": {"text": "Possibly dead Python function: run_daily_job"}, "properties": {"repobilityId": "766a160592f7af59", "scanner": "scanner-primary", "fingerprint": "46d6cde96c2aeb4c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cohort-agent/digest.py:176"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7f1a7c0594794452", "level": "note", "message": {"text": "Possibly dead Python function: filter"}, "properties": {"repobilityId": "7da968b6f6ed2422", "scanner": "scanner-primary", "fingerprint": "7f1a7c0594794452", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cohort-agent/telegram_bot.py:463"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2aec7940f9a4d97b", "level": "note", "message": {"text": "Possibly dead Python function: cmd_ask"}, "properties": {"repobilityId": "3bc3b0468a975c91", "scanner": "scanner-primary", "fingerprint": "2aec7940f9a4d97b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cohort-agent/telegram_bot.py:599"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6b313b9010447876", "level": "note", "message": {"text": "Possibly dead Python function: cmd_start"}, "properties": {"repobilityId": "fc872c8259f0135a", "scanner": "scanner-primary", "fingerprint": "6b313b9010447876", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cohort-agent/telegram_bot.py:611"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2149dbf818d68abc", "level": "note", "message": {"text": "Possibly dead Python function: cmd_health"}, "properties": {"repobilityId": "00e3d84060ff41fa", "scanner": "scanner-primary", "fingerprint": "2149dbf818d68abc", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cohort-agent/telegram_bot.py:623"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5a4afaa1478f7742", "level": "note", "message": {"text": "Possibly dead Python function: cmd_optout"}, "properties": {"repobilityId": "e4ad92abe6d80dd6", "scanner": "scanner-primary", "fingerprint": "5a4afaa1478f7742", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cohort-agent/telegram_bot.py:630"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2d7ef0689b523e97", "level": "note", "message": {"text": "Possibly dead Python function: cmd_optin"}, "properties": {"repobilityId": "e2768506e0c0b5b9", "scanner": "scanner-primary", "fingerprint": "2d7ef0689b523e97", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cohort-agent/telegram_bot.py:651"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0e0970e9d4600d56", "level": "note", "message": {"text": "Possibly dead Python function: cmd_post_retro"}, "properties": {"repobilityId": "f5bc176f87437bdb", "scanner": "scanner-primary", "fingerprint": "0e0970e9d4600d56", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cohort-agent/telegram_bot.py:692"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f64e7a5f838a3e28", "level": "note", "message": {"text": "Possibly dead Python function: cmd_skip_retro"}, "properties": {"repobilityId": "a8c36905102cb8cf", "scanner": "scanner-primary", "fingerprint": "f64e7a5f838a3e28", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cohort-agent/telegram_bot.py:755"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b98ba7175a9c7202", "level": "note", "message": {"text": "Possibly dead Python function: cmd_quiz"}, "properties": {"repobilityId": "234c910eeebbd8e0", "scanner": "scanner-primary", "fingerprint": "b98ba7175a9c7202", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cohort-agent/telegram_bot.py:907"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4fb5c117a1195e7f", "level": "note", "message": {"text": "Possibly dead Python function: cmd_poll"}, "properties": {"repobilityId": "b35746316fe74697", "scanner": "scanner-primary", "fingerprint": "4fb5c117a1195e7f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cohort-agent/telegram_bot.py:970"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-050660c57dd43eb5", "level": "note", "message": {"text": "Possibly dead Python function: cmd_preview_retro"}, "properties": {"repobilityId": "8a15b7fc0d372b0c", "scanner": "scanner-primary", "fingerprint": "050660c57dd43eb5", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cohort-agent/telegram_bot.py:1036"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2d63724ccd360e53", "level": "note", "message": {"text": "Possibly dead Python function: passive_log"}, "properties": {"repobilityId": "b44591f18e519d44", "scanner": "scanner-primary", "fingerprint": "2d63724ccd360e53", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cohort-agent/telegram_bot.py:1087"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-44ba2e9b5dc924f5", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "properties": {"repobilityId": "dfe89f156b67c40b", "scanner": "scanner-primary", "fingerprint": "44ba2e9b5dc924f5", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cohort-agent/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c842d013333fc296", "level": "note", "message": {"text": "Very large file: cohort-agent/telegram_bot.py (1293 lines)"}, "properties": {"repobilityId": "95c1bc89e924297b", "scanner": "scanner-primary", "fingerprint": "c842d013333fc296", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "4ab2893850336f70", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-981373369ad4633a", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: lesson2/starter-hook-template/codex-sdk-nodejs/package.json"}, "properties": {"repobilityId": "fc56c6f09ecfa61c", "scanner": "scanner-primary", "fingerprint": "981373369ad4633a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lesson2/starter-hook-template/codex-sdk-nodejs/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "a1dc1b50129fde77", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "37b48cf4123ededa", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "warning", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "f4b34d0c0472de5f", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "9ac55294f4e2e355", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-8bd3191ad8ed15eb", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: lesson2/starter-hook-template/agent-sdk-python/.claude/skills/my-task/SKILL.md"}, "properties": {"repobilityId": "9e4dbea3add7c733", "scanner": "scanner-primary", "fingerprint": "8bd3191ad8ed15eb", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lesson2/starter-hook-template/agent-sdk-python/.claude/skills/my-task/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-75e553123644226a", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: lesson2/starter-hook-template/codex-sdk-nodejs/.codex/hooks.json"}, "properties": {"repobilityId": "0f81c99f18c9ce67", "scanner": "scanner-primary", "fingerprint": "75e553123644226a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "codex_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lesson2/starter-hook-template/codex-sdk-nodejs/.codex/hooks.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-43464e5d17d71790", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: lesson2/starter-hook-template/codex-sdk-nodejs/.codex/skills/my-task/SKILL.md"}, "properties": {"repobilityId": "d49bd8e808096020", "scanner": "scanner-primary", "fingerprint": "43464e5d17d71790", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "codex_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lesson2/starter-hook-template/codex-sdk-nodejs/.codex/skills/my-task/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-282cde20f610d52f", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: lesson4/reference-colleague/CLAUDE.md"}, "properties": {"repobilityId": "248b5e818d5eedf7", "scanner": "scanner-primary", "fingerprint": "282cde20f610d52f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lesson4/reference-colleague/CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e1ad0d64a5810b90", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: lesson4/reference-colleague/skills/review-pr/SKILL.md"}, "properties": {"repobilityId": "3d1d921e15f15919", "scanner": "scanner-primary", "fingerprint": "e1ad0d64a5810b90", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lesson4/reference-colleague/skills/review-pr/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-14e384d6aedf4516", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: lesson4/reference-colleague/.claude/settings.json"}, "properties": {"repobilityId": "af5779164845a726", "scanner": "scanner-primary", "fingerprint": "14e384d6aedf4516", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lesson4/reference-colleague/.claude/settings.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-25e34770defa7e9a", "level": "none", "message": {"text": "Commented-code block (6 lines) in cohort-agent/digest.py:378"}, "properties": {"repobilityId": "90c34c8d926bcc3f", "scanner": "scanner-primary", "fingerprint": "25e34770defa7e9a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7c3d44e5764c4467", "level": "none", "message": {"text": "Commented-code block (7 lines) in cohort-agent/telegram_bot.py:1259"}, "properties": {"repobilityId": "3ce7d9955fd029dd", "scanner": "scanner-primary", "fingerprint": "7c3d44e5764c4467", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b0b5e7cb1208a7cd", "level": "note", "message": {"text": "13 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "2737b8666c1f7eeb", "scanner": "scanner-primary", "fingerprint": "b0b5e7cb1208a7cd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "51515eca3af8f13f", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "4f38e04c925692eb", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "8fd07b674b7c0b80", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "a5654b42c8785a85", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}]}]}