{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-fca33fe5e96da715", "name": "Possibly dead Python function: SubscribeEvents", "shortDescription": {"text": "Possibly dead Python function: SubscribeEvents"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b812a6535172d19d", "name": "Possibly dead Python function: generate_pkce_pair", "shortDescription": {"text": "Possibly dead Python function: generate_pkce_pair"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-52108d8843f4882d", "name": "Possibly dead Python function: verified_payload", "shortDescription": {"text": "Possibly dead Python function: verified_payload"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-400f2c42b643a1d7", "name": "Possibly dead Python function: dependency", "shortDescription": {"text": "Possibly dead Python function: dependency"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8bc4d8bad196d02f", "name": "Possibly dead Python function: filter_spans", "shortDescription": {"text": "Possibly dead Python function: filter_spans"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2167aa32ad75c158", "name": "Possibly dead Python function: do_run_migrations", "shortDescription": {"text": "Possibly dead Python function: do_run_migrations"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fa3abcfff09a0c43", "name": "Possibly dead Python function: upgrade", "shortDescription": {"text": "Possibly dead Python function: upgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e21f52f2136d0f67", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f58e16b845080347", "name": "Possibly dead Python function: upgrade", "shortDescription": {"text": "Possibly dead Python function: upgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f80e53da57dbff1a", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-815f1dfd7988180f", "name": "Possibly dead Python function: set_error", "shortDescription": {"text": "Possibly dead Python function: set_error"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-248f391d6ae9094e", "name": "Possibly dead Python function: chatbot_node", "shortDescription": {"text": "Possibly dead Python function: chatbot_node"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-429ef23f9c670caa", "name": "Possibly dead Python function: router_logic", "shortDescription": {"text": "Possibly dead Python function: router_logic"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2ac5e5f65964ded6", "name": "Possibly dead Python function: chatbot_node", "shortDescription": {"text": "Possibly dead Python function: chatbot_node"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8170b94f6ac52f2a", "name": "Possibly dead Python function: router_logic", "shortDescription": {"text": "Possibly dead Python function: router_logic"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5f53b6b3e5edf5e1", "name": "Possibly dead Python function: require_workspace_key", "shortDescription": {"text": "Possibly dead Python function: require_workspace_key"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72669823bdcbdb83", "name": "Possibly dead Python function: forward", "shortDescription": {"text": "Possibly dead Python function: forward"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-624851eaacdc6944", "name": "Possibly dead Python function: recommend_plan", "shortDescription": {"text": "Possibly dead Python function: recommend_plan"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fe41300b80dc26a2", "name": "Possibly dead Python function: ensure_partitions", "shortDescription": {"text": "Possibly dead Python function: ensure_partitions"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-896ef54512241740", "name": "Possibly dead Python function: ensure_vector_indexes", "shortDescription": {"text": "Possibly dead Python function: ensure_vector_indexes"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-803b4a161cb834ca", "name": "Possibly dead Python function: analyze_table", "shortDescription": {"text": "Possibly dead Python function: analyze_table"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5db680798339d06a", "name": "Possibly dead Python function: delete_by_document", "shortDescription": {"text": "Possibly dead Python function: delete_by_document"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6c6716ab3b3d0db6", "name": "Possibly dead Python function: contains_all", "shortDescription": {"text": "Possibly dead Python function: contains_all"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2197f339ec674e79", "name": "Possibly dead Python function: contains_any", "shortDescription": {"text": "Possibly dead Python function: contains_any"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c5d27d8c419d09a2", "name": "Possibly dead Python function: citation_present", "shortDescription": {"text": "Possibly dead Python function: citation_present"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-118d9da36f72a343", "name": "Possibly dead Python function: unknown_correctness", "shortDescription": {"text": "Possibly dead Python function: unknown_correctness"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0d285366feea70de", "name": "`truncate` class without `title=` for hover reveal \u2014 AIEngineering workflow toolkit/ui/src/pages/Dashboard.tsx:284", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 AIEngineering workflow toolkit/ui/src/pages/Dashboard.tsx:284"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e46a534169210f30", "name": "Icon-only button without accessible name \u2014 agent-observability/frontend/src/components/TraceViewer/SpanDetail.tsx:14", "shortDescription": {"text": "Icon-only button without accessible name \u2014 agent-observability/frontend/src/components/TraceViewer/SpanDetail.tsx:14"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d739b92f934a611f", "name": "`truncate` class without `title=` for hover reveal \u2014 agent-observability/frontend/src/components/TraceViewer/SpanRow.tsx", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 agent-observability/frontend/src/components/TraceViewer/SpanRow.tsx:29"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c7065002d68ba94e", "name": "Dockerfile runs as root: AIEngineering workflow toolkit/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: AIEngineering workflow toolkit/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1d11c4da99abf537", "name": "Docker base image is tag-pinned but not digest-pinned: node:20-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0f3afd0dbf8300f1", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-154926ada208f4d5", "name": "Dockerfile runs as root: agent-observability/frontend/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: agent-observability/frontend/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-246cda9519bdb55b", "name": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cf98cfa000296290", "name": "Docker base image is tag-pinned but not digest-pinned: nginx:alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: nginx:alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-052dee6473e585d3", "name": "Dockerfile runs as root: agent-observability/backend/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: agent-observability/backend/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-033cf222d47ba583", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-296e6fc9baae79f3", "name": "Dockerfile runs as root: vector-arena/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: vector-arena/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d4b5c736a12608fa", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7dccd6c7f63a8e5c", "name": "Dockerfile runs as root: rag-app/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: rag-app/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d7813719fc46ec1c", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.10-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.10-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cea30203fd81717d", "name": "Dockerfile runs as root: ai-native-data-platform/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: ai-native-data-platform/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5d116425061c9dec", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2dacb548500b139e", "name": "Dockerfile runs as root: recruiter-agent/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: recruiter-agent/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-62898d2cb71d85ed", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.10-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.10-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-495dbcdc8e1801b6", "name": "Insecure pattern 'cors_wildcard' in AIEngineering workflow toolkit/api/app.py:43", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in AIEngineering workflow toolkit/api/app.py:43"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-931b0653e86c2cdf", "name": "Possible secret in AIEngineering workflow toolkit/eval/golden_dataset.json", "shortDescription": {"text": "Possible secret in AIEngineering workflow toolkit/eval/golden_dataset.json"}, "fullDescription": {"text": "Detected pattern matching generic_api_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-67fb28522037467b", "name": "Insecure pattern 'subprocess_shell_true' in AIEngineering workflow toolkit/eval/golden_dataset.json:38", "shortDescription": {"text": "Insecure pattern 'subprocess_shell_true' in AIEngineering workflow toolkit/eval/golden_dataset.json:38"}, "fullDescription": {"text": "Found a known-risky pattern (subprocess_shell_true). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-15fed2f7b5d09b26", "name": "Insecure pattern 'local_storage_auth_token' in agent-observability/frontend/src/api/restClient.ts:63", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in agent-observability/frontend/src/api/restClient.ts:63"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9680a592a069fb4f", "name": "Possible secret in vector-arena/docker-compose.yml", "shortDescription": {"text": "Possible secret in vector-arena/docker-compose.yml"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-f1719f0f90154da6", "name": "Insecure pattern 'direct_innerhtml_assignment' in recruiter-agent/frontend/index.html:286", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in recruiter-agent/frontend/index.html:286"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-39cc21c391d1cd9b", "name": "Insecure pattern 'local_storage_auth_token' in recruiter-agent/frontend/index.html:347", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in recruiter-agent/frontend/index.html:347"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-51c38f6910a1b79d", "name": "Insecure pattern 'cors_wildcard' in recruiter-agent/app/server.py:38", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in recruiter-agent/app/server.py:38"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9882618a8406987c", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "grafana/k6-action@v0.3.1 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-31c64b86c2689981", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-057651efa21d8acb", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "grafana/k6-action@v0.3.1 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c7df2310f9a3ed4", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-python@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-671e23c40699188e", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4643702eb442486e", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "14 test file(s) for 307 source file(s) (ratio 0.05). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-47cae0f7be9d3511", "name": "Node manifest has dependencies but no lockfile: agent-observability/frontend/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: agent-observability/frontend/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 203 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 30 placeholder/mock markers across 16 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci, lockfile. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, ci, lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7cc6a9de62360d87", "name": "Agent authority lacks a verifier contract: AIEngineering workflow toolkit/AGENTS.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: AIEngineering workflow toolkit/AGENTS.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bf1c6064e9e98175", "name": "Agent authority lacks a verifier contract: AIEngineering workflow toolkit/.claude/settings.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: AIEngineering workflow toolkit/.claude/settings.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-abd2a003586d6d0d", "name": "Agent authority lacks a verifier contract: AIEngineering workflow toolkit/.claude/settings.local.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: AIEngineering workflow toolkit/.claude/settings.local.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1d164dc461a70938", "name": "Agent authority lacks a verifier contract: agent-observability/.claude/settings.local.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: agent-observability/.claude/settings.local.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0345723caca63c63", "name": "Agent authority lacks a verifier contract: Claude Code Architect Certification/.mcp.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: Claude Code Architect Certification/.mcp.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-87b036d8c056a345", "name": "Agent authority lacks a verifier contract: Claude Code Architect Certification/.claude/settings.local.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: Claude Code Architect Certification/.claude/settings.local.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4fded3fb23bf9181", "name": "Agent authority lacks a verifier contract: Claude Code Architect Certification/.claude/rules/agents.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: Claude Code Architect Certification/.claude/rules/agents.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-13d893dd137b8eeb", "name": "Agent authority lacks a verifier contract: Claude Code Architect Certification/.claude/commands/review-pr.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: Claude Code Architect Certification/.claude/commands/review-pr.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-92eb99d52ef25776", "name": "Agent authority lacks a verifier contract: Claude Code Architect Certification/.claude/commands/run-evals.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: Claude Code Architect Certification/.claude/commands/run-evals.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-41400c4642c2f4e6", "name": "Agent authority lacks a verifier contract: Claude Code Architect Certification/.claude/commands/analyze-ticket.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: Claude Code Architect Certification/.claude/commands/analyze-ticket.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e1bef2f392d6a1e6", "name": "Agent authority lacks a verifier contract: Claude Code Architect Certification/.claude/commands/batch-process.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: Claude Code Architect Certification/.claude/commands/batch-process.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e072a11911d2c3a3", "name": "Agent authority lacks a verifier contract: recruiter-agent/.claude/settings.local.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: recruiter-agent/.claude/settings.local.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9fdf07f4843ad14a", "name": "Network/subprocess call without timeout or try/except \u2014 AIEngineering workflow toolkit/main.py:92", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 AIEngineering workflow toolkit/main.py:92"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-11db0ff88129115d", "name": "`fetch()` without try/.catch or AbortSignal \u2014 AIEngineering workflow toolkit/ui/src/api/client.ts:29", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 AIEngineering workflow toolkit/ui/src/api/client.ts:29"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3bf45cc00f6e08e8", "name": "Commented-code block (5 lines) in AIEngineering workflow toolkit/subagents/architecture_agent.py:9", "shortDescription": {"text": "Commented-code block (5 lines) in AIEngineering workflow toolkit/subagents/architecture_agent.py:9"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-dccca42f07a21d3c", "name": "Network/subprocess call without timeout or try/except \u2014 AIEngineering workflow toolkit/.claude/hooks/pre_tool_use.py:37", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 AIEngineering workflow toolkit/.claude/hooks/pre_tool_use.py:37"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6953ee1ddd64f0ac", "name": "Commented-code block (8 lines) in AIEngineering workflow toolkit/mcp_server/server.py:127", "shortDescription": {"text": "Commented-code block (8 lines) in AIEngineering workflow toolkit/mcp_server/server.py:127"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-83b242fcce824036", "name": "Legacy-named symbol `style_review_v1` in AIEngineering workflow toolkit/skills/loader.py:51", "shortDescription": {"text": "Legacy-named symbol `style_review_v1` in AIEngineering workflow toolkit/skills/loader.py:51"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6598fb0000ff790f", "name": "Commented-code block (5 lines) in agent-observability/frontend/src/api/restClient.ts:9", "shortDescription": {"text": "Commented-code block (5 lines) in agent-observability/frontend/src/api/restClient.ts:9"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0a73b1f8034b46c8", "name": "Network/subprocess call without timeout or try/except \u2014 agent-observability/scripts/generate_proto.py:22", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 agent-observability/scripts/generate_proto.py:22"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9fa76aeca2591903", "name": "Legacy-named symbol `health_v1` in agent-observability/backend/app/main.py:48", "shortDescription": {"text": "Legacy-named symbol `health_v1` in agent-observability/backend/app/main.py:48"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f53a32916b977c42", "name": "Network/subprocess call without timeout or try/except \u2014 rag-app/frontend.py:26", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 rag-app/frontend.py:26"}, "fullDescription": {"text": "`requests.post(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4a1e1cd327168c43", "name": "Network/subprocess call without timeout or try/except \u2014 ai-native-data-platform/app/eval/scheduler/run.py:57", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 ai-native-data-platform/app/eval/scheduler/run.py:57"}, "fullDescription": {"text": "`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7aa99b5fd350fa41", "name": "Commented-code block (6 lines) in Claude Code Architect Certification/anti_patterns/01_vague_tool_descriptions.py:119", "shortDescription": {"text": "Commented-code block (6 lines) in Claude Code Architect Certification/anti_patterns/01_vague_tool_descriptions.py:119"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-867d2adc09002861", "name": "Commented-code block (5 lines) in Claude Code Architect Certification/anti_patterns/04_vague_confidence_threshold.py:20", "shortDescription": {"text": "Commented-code block (5 lines) in Claude Code Architect Certification/anti_patterns/04_vague_confidence_threshold.py:20"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7f6d4ecfbf1e00c3", "name": "Commented-code block (5 lines) in Claude Code Architect Certification/anti_patterns/02_missing_subagent_context.py:143", "shortDescription": {"text": "Commented-code block (5 lines) in Claude Code Architect Certification/anti_patterns/02_missing_subagent_context.py:143"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4cdd5744573fe431", "name": "Legacy-named symbol `eleven_turbo_v2` in recruiter-agent/benchmark_voice.py:160", "shortDescription": {"text": "Legacy-named symbol `eleven_turbo_v2` in recruiter-agent/benchmark_voice.py:160"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eac84ba2bf3dc2fa", "name": "Commented-code block (5 lines) in recruiter-agent/app/voice.py:356", "shortDescription": {"text": "Commented-code block (5 lines) in recruiter-agent/app/voice.py:356"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f7cafa45197dc23c", "name": "Legacy-named symbol `t_old` in recruiter-agent/eval/compare_versions.py:245", "shortDescription": {"text": "Legacy-named symbol `t_old` in recruiter-agent/eval/compare_versions.py:245"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fb87f14083523571", "name": "147 env vars used in code but missing from .env.example", "shortDescription": {"text": "147 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `ADMIN_TOKEN`, `AIWT_DATA_DIR`, `AIWT_DEBUG`, `AIWT_EVAL_CONCURRENCY`, `AZURE_SEARCH_ENDPOINT`, `AZURE_SEARCH_INDEX`, `AZURE_SEARCH_KEY`, `CHROMA_COLLECTION` + 139 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nagent-observability/sdk/agent_observability/emitter.py:emit, agent-observability/sdk/agent_observability/emitter.py:emit\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nai-native-data-platform/app/ingestion/worker.py:start_worker, ai-native-data-platform/app/ingestion/multimodal.py:start_multimodal_worker, ai-native-data-platform/app/ingestion/pipeline.py:start_worker\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-76a2f6818267a9a8", "name": "Near-duplicate function bodies in 8 places", "shortDescription": {"text": "Near-duplicate function bodies in 8 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nai-native-data-platform/app/retrieval/pipeline.py:retrieve, ai-native-data-platform/app/retrieval/retrievers/opensearch_retriever.py:retrieve, ai-native-data-platform/app/retrieval/retrievers/opensearch_retriever.py:retrieve, ai-native-data-platform/app/retrieval/retrievers/opensearch_retriever.py:retrieve\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-28f88f46f907009b", "name": "Frontend route `/reviews/:id` has no Link/navigate to it \u2014 AIEngineering workflow toolkit/ui/src/App.tsx", "shortDescription": {"text": "Frontend route `/reviews/:id` has no Link/navigate to it \u2014 AIEngineering workflow toolkit/ui/src/App.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6b3e5d34657fb227", "name": "Frontend route `/auth/callback` has no Link/navigate to it \u2014 agent-observability/frontend/src/App.tsx", "shortDescription": {"text": "Frontend route `/auth/callback` has no Link/navigate to it \u2014 agent-observability/frontend/src/App.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e64fa12c6239bf4a", "name": "FastAPI POST `submit_review` without auth dependency \u2014 AIEngineering workflow toolkit/api/app.py:68", "shortDescription": {"text": "FastAPI POST `submit_review` without auth dependency \u2014 AIEngineering workflow toolkit/api/app.py:68"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-34ab99c38fb3a735", "name": "FastAPI POST `create_user` without auth dependency \u2014 agent-observability/backend/app/routers/admin.py:74", "shortDescription": {"text": "FastAPI POST `create_user` without auth dependency \u2014 agent-observability/backend/app/routers/admin.py:74"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-319b0133b66def89", "name": "FastAPI PATCH `update_user` without auth dependency \u2014 agent-observability/backend/app/routers/admin.py:97", "shortDescription": {"text": "FastAPI PATCH `update_user` without auth dependency \u2014 agent-observability/backend/app/routers/admin.py:97"}, "fullDescription": {"text": "`@router.patch` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-81bab7672ee9606e", "name": "FastAPI POST `revoke_sessions` without auth dependency \u2014 agent-observability/backend/app/routers/admin.py:131", "shortDescription": {"text": "FastAPI POST `revoke_sessions` without auth dependency \u2014 agent-observability/backend/app/routers/admin.py:131"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-864c54e6eb6db76b", "name": "FastAPI POST `investigate` without auth dependency \u2014 Claude Code Architect Certification/api/app.py:26", "shortDescription": {"text": "FastAPI POST `investigate` without auth dependency \u2014 Claude Code Architect Certification/api/app.py:26"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d737ec535e4193b3", "name": "FastAPI POST `chat_endpoint` without auth dependency \u2014 recruiter-agent/app/server.py:96", "shortDescription": {"text": "FastAPI POST `chat_endpoint` without auth dependency \u2014 recruiter-agent/app/server.py:96"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1c0278cd2dfdcc22", "name": "FastAPI POST `mcp_call_endpoint` without auth dependency \u2014 recruiter-agent/app/server.py:228", "shortDescription": {"text": "FastAPI POST `mcp_call_endpoint` without auth dependency \u2014 recruiter-agent/app/server.py:228"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-74635ed8e80c0bf1", "name": "FastAPI POST `a2a_validate_endpoint` without auth dependency \u2014 recruiter-agent/app/server.py:261", "shortDescription": {"text": "FastAPI POST `a2a_validate_endpoint` without auth dependency \u2014 recruiter-agent/app/server.py:261"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a7819b78b73d9b12", "name": "FastAPI POST `webrtc_offer_endpoint` without auth dependency \u2014 recruiter-agent/app/server.py:305", "shortDescription": {"text": "FastAPI POST `webrtc_offer_endpoint` without auth dependency \u2014 recruiter-agent/app/server.py:305"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-337dbf9863bc6f31", "name": "FastAPI DELETE `webrtc_cleanup_endpoint` without auth dependency \u2014 recruiter-agent/app/server.py:327", "shortDescription": {"text": "FastAPI DELETE `webrtc_cleanup_endpoint` without auth dependency \u2014 recruiter-agent/app/server.py:327"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8cc109f716156ca7", "name": "FastAPI POST `create_campaign_endpoint` without auth dependency \u2014 recruiter-agent/app/server.py:345", "shortDescription": {"text": "FastAPI POST `create_campaign_endpoint` without auth dependency \u2014 recruiter-agent/app/server.py:345"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ac23b53fa2d40d88", "name": "FastAPI POST `start_campaign_endpoint` without auth dependency \u2014 recruiter-agent/app/server.py:363", "shortDescription": {"text": "FastAPI POST `start_campaign_endpoint` without auth dependency \u2014 recruiter-agent/app/server.py:363"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-046c325606842527", "name": "FastAPI POST `pause_campaign_endpoint` without auth dependency \u2014 recruiter-agent/app/server.py:369", "shortDescription": {"text": "FastAPI POST `pause_campaign_endpoint` without auth dependency \u2014 recruiter-agent/app/server.py:369"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ccc76bc62aa3e8d9", "name": "FastAPI POST `opt_out_endpoint` without auth dependency \u2014 recruiter-agent/app/server.py:384", "shortDescription": {"text": "FastAPI POST `opt_out_endpoint` without auth dependency \u2014 recruiter-agent/app/server.py:384"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6c23cd758613e461", "name": "FastAPI POST `outbound_callback_endpoint` without auth dependency \u2014 recruiter-agent/app/server.py:391", "shortDescription": {"text": "FastAPI POST `outbound_callback_endpoint` without auth dependency \u2014 recruiter-agent/app/server.py:391"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c36682309c49b8d9", "name": "FastAPI POST `outbound_twiml_endpoint` without auth dependency \u2014 recruiter-agent/app/server.py:401", "shortDescription": {"text": "FastAPI POST `outbound_twiml_endpoint` without auth dependency \u2014 recruiter-agent/app/server.py:401"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-faa3fb8af9f1485f", "name": "FastAPI POST `phone_twiml_endpoint` without auth dependency \u2014 recruiter-agent/app/server.py:422", "shortDescription": {"text": "FastAPI POST `phone_twiml_endpoint` without auth dependency \u2014 recruiter-agent/app/server.py:422"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-220ebcfbe1af356c", "name": "Unused endpoint: POST /api/reviews", "shortDescription": {"text": "Unused endpoint: POST /api/reviews"}, "fullDescription": {"text": "`AIEngineering workflow toolkit/api/app.py` declares `POST /api/reviews` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8cbf6af853ff55b8", "name": "Unused endpoint: GET /api/reviews", "shortDescription": {"text": "Unused endpoint: GET /api/reviews"}, "fullDescription": {"text": "`AIEngineering workflow toolkit/api/app.py` declares `GET /api/reviews` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a6680f1b59dcb1ed", "name": "Unused endpoint: GET /api/reviews/{review_id}", "shortDescription": {"text": "Unused endpoint: GET /api/reviews/{review_id}"}, "fullDescription": {"text": "`AIEngineering workflow toolkit/api/app.py` declares `GET /api/reviews/{review_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3b37265900e79a8a", "name": "Unused endpoint: GET /api/stats", "shortDescription": {"text": "Unused endpoint: GET /api/stats"}, "fullDescription": {"text": "`AIEngineering workflow toolkit/api/app.py` declares `GET /api/stats` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5fa57b0705efe6d8", "name": "Unused endpoint: GET /api/eval/latest", "shortDescription": {"text": "Unused endpoint: GET /api/eval/latest"}, "fullDescription": {"text": "`AIEngineering workflow toolkit/api/app.py` declares `GET /api/eval/latest` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-308b6e56c5334f41", "name": "Unused endpoint: GET /api/eval/history", "shortDescription": {"text": "Unused endpoint: GET /api/eval/history"}, "fullDescription": {"text": "`AIEngineering workflow toolkit/api/app.py` declares `GET /api/eval/history` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`AIEngineering workflow toolkit/api/app.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1b1d5926fda286fa", "name": "Unused endpoint: GET /{full_path:path}", "shortDescription": {"text": "Unused endpoint: GET /{full_path:path}"}, "fullDescription": {"text": "`AIEngineering workflow toolkit/api/app.py` declares `GET /{full_path:path}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4756b4c4da7d2088", "name": "Unused endpoint: GET /api/health", "shortDescription": {"text": "Unused endpoint: GET /api/health"}, "fullDescription": {"text": "`agent-observability/backend/app/main.py` declares `GET /api/health` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d345fa90f5de3745", "name": "Unused endpoint: GET /authorize", "shortDescription": {"text": "Unused endpoint: GET /authorize"}, "fullDescription": {"text": "`agent-observability/backend/app/routers/auth.py` declares `GET /authorize` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6c4452e1c08b3191", "name": "Unused endpoint: POST /callback", "shortDescription": {"text": "Unused endpoint: POST /callback"}, "fullDescription": {"text": "`agent-observability/backend/app/routers/auth.py` declares `POST /callback` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-99fc36db98c134ce", "name": "Unused endpoint: POST /logout", "shortDescription": {"text": "Unused endpoint: POST /logout"}, "fullDescription": {"text": "`agent-observability/backend/app/routers/auth.py` declares `POST /logout` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a009b1a56794f45", "name": "Unused endpoint: POST /", "shortDescription": {"text": "Unused endpoint: POST /"}, "fullDescription": {"text": "`agent-observability/backend/app/routers/evals.py` declares `POST /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1d944294f9a29ca0", "name": "Unused endpoint: POST /{run_id}/results", "shortDescription": {"text": "Unused endpoint: POST /{run_id}/results"}, "fullDescription": {"text": "`agent-observability/backend/app/routers/evals.py` declares `POST /{run_id}/results` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-87f033efdf5491d6", "name": "Unused endpoint: DELETE /{run_id}", "shortDescription": {"text": "Unused endpoint: DELETE /{run_id}"}, "fullDescription": {"text": "`agent-observability/backend/app/routers/evals.py` declares `DELETE /{run_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0cfd14d6d4f9945c", "name": "Unused endpoint: GET /{trace_id}", "shortDescription": {"text": "Unused endpoint: GET /{trace_id}"}, "fullDescription": {"text": "`agent-observability/backend/app/routers/traces.py` declares `GET /{trace_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-841e50bf821e4158", "name": "Unused endpoint: GET /users", "shortDescription": {"text": "Unused endpoint: GET /users"}, "fullDescription": {"text": "`agent-observability/backend/app/routers/admin.py` declares `GET /users` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1bca8100a44f7f25", "name": "Unused endpoint: POST /users", "shortDescription": {"text": "Unused endpoint: POST /users"}, "fullDescription": {"text": "`agent-observability/backend/app/routers/admin.py` declares `POST /users` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cc679d62b533e7b6", "name": "Unused endpoint: PATCH /users/{user_id}", "shortDescription": {"text": "Unused endpoint: PATCH /users/{user_id}"}, "fullDescription": {"text": "`agent-observability/backend/app/routers/admin.py` declares `PATCH /users/{user_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-03ee6e65afee8ef1", "name": "Unused endpoint: POST /users/{user_id}/revoke-sessions", "shortDescription": {"text": "Unused endpoint: POST /users/{user_id}/revoke-sessions"}, "fullDescription": {"text": "`agent-observability/backend/app/routers/admin.py` declares `POST /users/{user_id}/revoke-sessions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-00d297d86aa253fe", "name": "Unused endpoint: GET /audit", "shortDescription": {"text": "Unused endpoint: GET /audit"}, "fullDescription": {"text": "`agent-observability/backend/app/routers/admin.py` declares `GET /audit` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8e1fadad2500f063", "name": "Unused endpoint: POST /ask", "shortDescription": {"text": "Unused endpoint: POST /ask"}, "fullDescription": {"text": "`rag-app/main.py` declares `POST /ask` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-07c8058844c53ae8", "name": "Unused endpoint: POST /act", "shortDescription": {"text": "Unused endpoint: POST /act"}, "fullDescription": {"text": "`rag-app/main.py` declares `POST /act` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-08fe27b8bc6050ae", "name": "Unused endpoint: POST /ingest/transcript", "shortDescription": {"text": "Unused endpoint: POST /ingest/transcript"}, "fullDescription": {"text": "`ai-native-data-platform/app/api/main.py` declares `POST /ingest/transcript` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7909a52cb9cfec36", "name": "Unused endpoint: POST /ingest/image", "shortDescription": {"text": "Unused endpoint: POST /ingest/image"}, "fullDescription": {"text": "`ai-native-data-platform/app/api/main.py` declares `POST /ingest/image` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d3f92ef9f2a961f3", "name": "Unused endpoint: POST /query/natural-language", "shortDescription": {"text": "Unused endpoint: POST /query/natural-language"}, "fullDescription": {"text": "`ai-native-data-platform/app/api/main.py` declares `POST /query/natural-language` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-520d4d671fb65050", "name": "Unused endpoint: POST /investigate", "shortDescription": {"text": "Unused endpoint: POST /investigate"}, "fullDescription": {"text": "`Claude Code Architect Certification/api/app.py` declares `POST /investigate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-91786ec9e40e27ca", "name": "Unused endpoint: GET /{path:path}", "shortDescription": {"text": "Unused endpoint: GET /{path:path}"}, "fullDescription": {"text": "`recruiter-agent/app/server.py` declares `GET /{path:path}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cff8da5fbc19c76d", "name": "Unused endpoint: POST /chat", "shortDescription": {"text": "Unused endpoint: POST /chat"}, "fullDescription": {"text": "`recruiter-agent/app/server.py` declares `POST /chat` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-066d9d6875914444", "name": "Unused endpoint: GET /mcp/tools", "shortDescription": {"text": "Unused endpoint: GET /mcp/tools"}, "fullDescription": {"text": "`recruiter-agent/app/server.py` declares `GET /mcp/tools` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c8cd893d1050b73f", "name": "Unused endpoint: POST /mcp/call", "shortDescription": {"text": "Unused endpoint: POST /mcp/call"}, "fullDescription": {"text": "`recruiter-agent/app/server.py` declares `POST /mcp/call` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-041bbc7191989675", "name": "Unused endpoint: POST /a2a/validate", "shortDescription": {"text": "Unused endpoint: POST /a2a/validate"}, "fullDescription": {"text": "`recruiter-agent/app/server.py` declares `POST /a2a/validate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-30f051c71453cec2", "name": "Unused endpoint: POST /webrtc/offer", "shortDescription": {"text": "Unused endpoint: POST /webrtc/offer"}, "fullDescription": {"text": "`recruiter-agent/app/server.py` declares `POST /webrtc/offer` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b1b9ab229d25182a", "name": "Unused endpoint: DELETE /webrtc/{pc_id}", "shortDescription": {"text": "Unused endpoint: DELETE /webrtc/{pc_id}"}, "fullDescription": {"text": "`recruiter-agent/app/server.py` declares `DELETE /webrtc/{pc_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-52b054791efb43e7", "name": "Unused endpoint: POST /outbound/campaign", "shortDescription": {"text": "Unused endpoint: POST /outbound/campaign"}, "fullDescription": {"text": "`recruiter-agent/app/server.py` declares `POST /outbound/campaign` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-04761c42b0ec3c86", "name": "Unused endpoint: POST /outbound/campaign/{campaign_id}/start", "shortDescription": {"text": "Unused endpoint: POST /outbound/campaign/{campaign_id}/start"}, "fullDescription": {"text": "`recruiter-agent/app/server.py` declares `POST /outbound/campaign/{campaign_id}/start` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5cf69f1688cb19aa", "name": "Unused endpoint: POST /outbound/campaign/{campaign_id}/pause", "shortDescription": {"text": "Unused endpoint: POST /outbound/campaign/{campaign_id}/pause"}, "fullDescription": {"text": "`recruiter-agent/app/server.py` declares `POST /outbound/campaign/{campaign_id}/pause` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5238a1f39a5fbf7f", "name": "Unused endpoint: GET /outbound/campaign/{campaign_id}", "shortDescription": {"text": "Unused endpoint: GET /outbound/campaign/{campaign_id}"}, "fullDescription": {"text": "`recruiter-agent/app/server.py` declares `GET /outbound/campaign/{campaign_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8f3676c4932766b3", "name": "Unused endpoint: POST /outbound/opt-out", "shortDescription": {"text": "Unused endpoint: POST /outbound/opt-out"}, "fullDescription": {"text": "`recruiter-agent/app/server.py` declares `POST /outbound/opt-out` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7726ec43eb87b7b1", "name": "Unused endpoint: POST /outbound/callback", "shortDescription": {"text": "Unused endpoint: POST /outbound/callback"}, "fullDescription": {"text": "`recruiter-agent/app/server.py` declares `POST /outbound/callback` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8149b05484be2fd4", "name": "Unused endpoint: POST /phone/twiml/outbound", "shortDescription": {"text": "Unused endpoint: POST /phone/twiml/outbound"}, "fullDescription": {"text": "`recruiter-agent/app/server.py` declares `POST /phone/twiml/outbound` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7df9d677813ec3c7", "name": "Unused endpoint: GET /outbound/status", "shortDescription": {"text": "Unused endpoint: GET /outbound/status"}, "fullDescription": {"text": "`recruiter-agent/app/server.py` declares `GET /outbound/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8eda29045649f743", "name": "Unused endpoint: POST /phone/twiml", "shortDescription": {"text": "Unused endpoint: POST /phone/twiml"}, "fullDescription": {"text": "`recruiter-agent/app/server.py` declares `POST /phone/twiml` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-deaaea4281e57678", "name": "Unused endpoint: GET /a2a/summary/{session_id}", "shortDescription": {"text": "Unused endpoint: GET /a2a/summary/{session_id}"}, "fullDescription": {"text": "`recruiter-agent/app/server.py` declares `GET /a2a/summary/{session_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8158bd1cc68feffa", "name": "Unused endpoint: GET /session/{session_id}/summary", "shortDescription": {"text": "Unused endpoint: GET /session/{session_id}/summary"}, "fullDescription": {"text": "`recruiter-agent/app/server.py` declares `GET /session/{session_id}/summary` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c059f57186114027", "name": "Unused endpoint: POST /auth/logout", "shortDescription": {"text": "Unused endpoint: POST /auth/logout"}, "fullDescription": {"text": "`agent-observability/frontend/src/api/restClient.ts` declares `POST /auth/logout` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6c9282666b199ce9", "name": "Unused endpoint: GET /admin/audit", "shortDescription": {"text": "Unused endpoint: GET /admin/audit"}, "fullDescription": {"text": "`agent-observability/frontend/src/api/restClient.ts` declares `GET /admin/audit` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/19300"}, "properties": {"repository": "sergiunicoara/Agentic-AI", "repoUrl": "https://github.com/sergiunicoara/Agentic-AI", "branch": "main"}, "results": [{"ruleId": "scanner-fca33fe5e96da715", "level": "note", "message": {"text": "Possibly dead Python function: SubscribeEvents"}, "properties": {"repobilityId": "f87418468bbfb928", "scanner": "scanner-primary", "fingerprint": "fca33fe5e96da715", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent-observability/backend/app/grpc_server.py:40"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b812a6535172d19d", "level": "note", "message": {"text": "Possibly dead Python function: generate_pkce_pair"}, "properties": {"repobilityId": "20ff38a39bb362e0", "scanner": "scanner-primary", "fingerprint": "b812a6535172d19d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent-observability/backend/app/services/oidc_service.py:46"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-52108d8843f4882d", "level": "note", "message": {"text": "Possibly dead Python function: verified_payload"}, "properties": {"repobilityId": "907fe47bd1ea37fc", "scanner": "scanner-primary", "fingerprint": "52108d8843f4882d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent-observability/backend/app/services/auth_service.py:100"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-400f2c42b643a1d7", "level": "note", "message": {"text": "Possibly dead Python function: dependency"}, "properties": {"repobilityId": "e2f97c76f5b6acb6", "scanner": "scanner-primary", "fingerprint": "400f2c42b643a1d7", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent-observability/backend/app/services/auth_service.py:122"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8bc4d8bad196d02f", "level": "note", "message": {"text": "Possibly dead Python function: filter_spans"}, "properties": {"repobilityId": "2953d7dfd059571c", "scanner": "scanner-primary", "fingerprint": "8bc4d8bad196d02f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent-observability/backend/app/services/abac.py:75"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2167aa32ad75c158", "level": "note", "message": {"text": "Possibly dead Python function: do_run_migrations"}, "properties": {"repobilityId": "087acb17722cfd2f", "scanner": "scanner-primary", "fingerprint": "2167aa32ad75c158", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent-observability/backend/alembic/env.py:29"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fa3abcfff09a0c43", "level": "note", "message": {"text": "Possibly dead Python function: upgrade"}, "properties": {"repobilityId": "cf0b8e5e6e2f8bc4", "scanner": "scanner-primary", "fingerprint": "fa3abcfff09a0c43", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent-observability/backend/alembic/versions/0001_initial.py:17"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e21f52f2136d0f67", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "e21f52f2136d0f67", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent-observability/backend/alembic/versions/0001_initial.py:102"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f58e16b845080347", "level": "note", "message": {"text": "Possibly dead Python function: upgrade"}, "properties": {"repobilityId": "cf0b8e5e6e2f8bc4", "scanner": "scanner-primary", "fingerprint": "f58e16b845080347", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent-observability/backend/alembic/versions/0002_oidc_abac.py:16"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f80e53da57dbff1a", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "f80e53da57dbff1a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent-observability/backend/alembic/versions/0002_oidc_abac.py:26"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-815f1dfd7988180f", "level": "note", "message": {"text": "Possibly dead Python function: set_error"}, "properties": {"repobilityId": "75daa2bca685aa0a", "scanner": "scanner-primary", "fingerprint": "815f1dfd7988180f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent-observability/sdk/agent_observability/span.py:39"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-248f391d6ae9094e", "level": "note", "message": {"text": "Possibly dead Python function: chatbot_node"}, "properties": {"repobilityId": "6ff77d0646a2246e", "scanner": "scanner-primary", "fingerprint": "248f391d6ae9094e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "rag-app/integrated_agent.py:88"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-429ef23f9c670caa", "level": "note", "message": {"text": "Possibly dead Python function: router_logic"}, "properties": {"repobilityId": "b216b5509aa73e67", "scanner": "scanner-primary", "fingerprint": "429ef23f9c670caa", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "rag-app/integrated_agent.py:94"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2ac5e5f65964ded6", "level": "note", "message": {"text": "Possibly dead Python function: chatbot_node"}, "properties": {"repobilityId": "6ff77d0646a2246e", "scanner": "scanner-primary", "fingerprint": "2ac5e5f65964ded6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "rag-app/agent.py:48"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8170b94f6ac52f2a", "level": "note", "message": {"text": "Possibly dead Python function: router_logic"}, "properties": {"repobilityId": "b216b5509aa73e67", "scanner": "scanner-primary", "fingerprint": "8170b94f6ac52f2a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "rag-app/agent.py:54"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5f53b6b3e5edf5e1", "level": "note", "message": {"text": "Possibly dead Python function: require_workspace_key"}, "properties": {"repobilityId": "1752195847179901", "scanner": "scanner-primary", "fingerprint": "5f53b6b3e5edf5e1", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ai-native-data-platform/app/auth.py:9"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-72669823bdcbdb83", "level": "note", "message": {"text": "Possibly dead Python function: forward"}, "properties": {"repobilityId": "ea414cce7f8e5874", "scanner": "scanner-primary", "fingerprint": "72669823bdcbdb83", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ai-native-data-platform/app/nl_query/dspy_intent.py:255"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-624851eaacdc6944", "level": "note", "message": {"text": "Possibly dead Python function: recommend_plan"}, "properties": {"repobilityId": "194c0aadcd26a216", "scanner": "scanner-primary", "fingerprint": "624851eaacdc6944", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ai-native-data-platform/app/vectorstore/pgvector_scaling.py:21"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fe41300b80dc26a2", "level": "note", "message": {"text": "Possibly dead Python function: ensure_partitions"}, "properties": {"repobilityId": "e708040317c2f699", "scanner": "scanner-primary", "fingerprint": "fe41300b80dc26a2", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ai-native-data-platform/app/vectorstore/pgvector_scaling.py:36"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-896ef54512241740", "level": "note", "message": {"text": "Possibly dead Python function: ensure_vector_indexes"}, "properties": {"repobilityId": "e2be413da4505ac2", "scanner": "scanner-primary", "fingerprint": "896ef54512241740", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ai-native-data-platform/app/vectorstore/pgvector_scaling.py:69"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-803b4a161cb834ca", "level": "note", "message": {"text": "Possibly dead Python function: analyze_table"}, "properties": {"repobilityId": "6361a67cabe5be4d", "scanner": "scanner-primary", "fingerprint": "803b4a161cb834ca", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ai-native-data-platform/app/vectorstore/pgvector_scaling.py:120"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5db680798339d06a", "level": "note", "message": {"text": "Possibly dead Python function: delete_by_document"}, "properties": {"repobilityId": "4674d26d88a1c18a", "scanner": "scanner-primary", "fingerprint": "5db680798339d06a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ai-native-data-platform/app/opensearch/ingest.py:173"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6c6716ab3b3d0db6", "level": "note", "message": {"text": "Possibly dead Python function: contains_all"}, "properties": {"repobilityId": "416656f272abc090", "scanner": "scanner-primary", "fingerprint": "6c6716ab3b3d0db6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ai-native-data-platform/app/eval/metrics.py:3"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2197f339ec674e79", "level": "note", "message": {"text": "Possibly dead Python function: contains_any"}, "properties": {"repobilityId": "63cc029b6ebcfb31", "scanner": "scanner-primary", "fingerprint": "2197f339ec674e79", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ai-native-data-platform/app/eval/metrics.py:7"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c5d27d8c419d09a2", "level": "note", "message": {"text": "Possibly dead Python function: citation_present"}, "properties": {"repobilityId": "9f20ac144ae3e55d", "scanner": "scanner-primary", "fingerprint": "c5d27d8c419d09a2", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ai-native-data-platform/app/eval/metrics.py:11"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-118d9da36f72a343", "level": "note", "message": {"text": "Possibly dead Python function: unknown_correctness"}, "properties": {"repobilityId": "e86806c8552eb735", "scanner": "scanner-primary", "fingerprint": "118d9da36f72a343", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ai-native-data-platform/app/eval/metrics.py:14"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0d285366feea70de", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 AIEngineering workflow toolkit/ui/src/pages/Dashboard.tsx:284"}, "properties": {"repobilityId": "c4f754d3c770274d", "scanner": "scanner-primary", "fingerprint": "0d285366feea70de", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-e46a534169210f30", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 agent-observability/frontend/src/components/TraceViewer/SpanDetail.tsx:14"}, "properties": {"repobilityId": "e00415303a5a673f", "scanner": "scanner-primary", "fingerprint": "e46a534169210f30", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-d739b92f934a611f", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 agent-observability/frontend/src/components/TraceViewer/SpanRow.tsx:29"}, "properties": {"repobilityId": "69cdd945c42bf905", "scanner": "scanner-primary", "fingerprint": "d739b92f934a611f", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-c7065002d68ba94e", "level": "warning", "message": {"text": "Dockerfile runs as root: AIEngineering workflow toolkit/Dockerfile"}, "properties": {"repobilityId": "b4d74516d3a80f14", "scanner": "scanner-primary", "fingerprint": "c7065002d68ba94e", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-1d11c4da99abf537", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-slim"}, "properties": {"repobilityId": "6d84657be8f1daef", "scanner": "scanner-primary", "fingerprint": "1d11c4da99abf537", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "AIEngineering workflow toolkit/Dockerfile"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-0f3afd0dbf8300f1", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "4a3171ed90b823ab", "scanner": "scanner-primary", "fingerprint": "0f3afd0dbf8300f1", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "AIEngineering workflow toolkit/Dockerfile"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-154926ada208f4d5", "level": "warning", "message": {"text": "Dockerfile runs as root: agent-observability/frontend/Dockerfile"}, "properties": {"repobilityId": "530de2b1bbacc5bb", "scanner": "scanner-primary", "fingerprint": "154926ada208f4d5", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-246cda9519bdb55b", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "properties": {"repobilityId": "f16c1f3b48ab78f9", "scanner": "scanner-primary", "fingerprint": "246cda9519bdb55b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent-observability/frontend/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cf98cfa000296290", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: nginx:alpine"}, "properties": {"repobilityId": "5eb5e8cb9abd0cf3", "scanner": "scanner-primary", "fingerprint": "cf98cfa000296290", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent-observability/frontend/Dockerfile"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-052dee6473e585d3", "level": "warning", "message": {"text": "Dockerfile runs as root: agent-observability/backend/Dockerfile"}, "properties": {"repobilityId": "9f3743ed71159183", "scanner": "scanner-primary", "fingerprint": "052dee6473e585d3", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-033cf222d47ba583", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "properties": {"repobilityId": "85befb6e0d9f1ff7", "scanner": "scanner-primary", "fingerprint": "033cf222d47ba583", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent-observability/backend/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-296e6fc9baae79f3", "level": "warning", "message": {"text": "Dockerfile runs as root: vector-arena/Dockerfile"}, "properties": {"repobilityId": "7d65beb68e0af81c", "scanner": "scanner-primary", "fingerprint": "296e6fc9baae79f3", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-d4b5c736a12608fa", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "a29288dac665f4ad", "scanner": "scanner-primary", "fingerprint": "d4b5c736a12608fa", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "vector-arena/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7dccd6c7f63a8e5c", "level": "warning", "message": {"text": "Dockerfile runs as root: rag-app/Dockerfile"}, "properties": {"repobilityId": "03f6f61fd6b7bbe3", "scanner": "scanner-primary", "fingerprint": "7dccd6c7f63a8e5c", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-d7813719fc46ec1c", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.10-slim"}, "properties": {"repobilityId": "60006ecf9bb692f6", "scanner": "scanner-primary", "fingerprint": "d7813719fc46ec1c", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "rag-app/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cea30203fd81717d", "level": "warning", "message": {"text": "Dockerfile runs as root: ai-native-data-platform/Dockerfile"}, "properties": {"repobilityId": "bc71435d5de21791", "scanner": "scanner-primary", "fingerprint": "cea30203fd81717d", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-5d116425061c9dec", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "e449b861ac524855", "scanner": "scanner-primary", "fingerprint": "5d116425061c9dec", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ai-native-data-platform/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2dacb548500b139e", "level": "warning", "message": {"text": "Dockerfile runs as root: recruiter-agent/Dockerfile"}, "properties": {"repobilityId": "155ddf800d6f0d0c", "scanner": "scanner-primary", "fingerprint": "2dacb548500b139e", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-62898d2cb71d85ed", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.10-slim"}, "properties": {"repobilityId": "20f39ff3a8aca72d", "scanner": "scanner-primary", "fingerprint": "62898d2cb71d85ed", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "recruiter-agent/Dockerfile"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-495dbcdc8e1801b6", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in AIEngineering workflow toolkit/api/app.py:43"}, "properties": {"repobilityId": "00af145048e3eaf2", "scanner": "scanner-primary", "fingerprint": "495dbcdc8e1801b6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "AIEngineering workflow toolkit/api/app.py"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-931b0653e86c2cdf", "level": "error", "message": {"text": "Possible secret in AIEngineering workflow toolkit/eval/golden_dataset.json"}, "properties": {"repobilityId": "fe0e0cbf2f67ada7", "scanner": "scanner-primary", "fingerprint": "931b0653e86c2cdf", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "AIEngineering workflow toolkit/eval/golden_dataset.json"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-67fb28522037467b", "level": "warning", "message": {"text": "Insecure pattern 'subprocess_shell_true' in AIEngineering workflow toolkit/eval/golden_dataset.json:38"}, "properties": {"repobilityId": "54d333a114990e59", "scanner": "scanner-primary", "fingerprint": "67fb28522037467b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "subprocess_shell_true"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "AIEngineering workflow toolkit/eval/golden_dataset.json"}, "region": {"startLine": 38}}}]}, {"ruleId": "scanner-15fed2f7b5d09b26", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in agent-observability/frontend/src/api/restClient.ts:63"}, "properties": {"repobilityId": "be6cab01cbde31b0", "scanner": "scanner-primary", "fingerprint": "15fed2f7b5d09b26", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent-observability/frontend/src/api/restClient.ts"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-9680a592a069fb4f", "level": "error", "message": {"text": "Possible secret in vector-arena/docker-compose.yml"}, "properties": {"repobilityId": "99cfad5c8e39f4a3", "scanner": "scanner-primary", "fingerprint": "9680a592a069fb4f", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "vector-arena/docker-compose.yml"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-9680a592a069fb4f", "level": "error", "message": {"text": "Possible secret in vector-arena/docker-compose.yml"}, "properties": {"repobilityId": "99cfad5c8e39f4a3", "scanner": "scanner-primary", "fingerprint": "9680a592a069fb4f", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "vector-arena/docker-compose.yml"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-f1719f0f90154da6", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in recruiter-agent/frontend/index.html:286"}, "properties": {"repobilityId": "49dca97f36aebbb1", "scanner": "scanner-primary", "fingerprint": "f1719f0f90154da6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "recruiter-agent/frontend/index.html"}, "region": {"startLine": 286}}}]}, {"ruleId": "scanner-39cc21c391d1cd9b", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in recruiter-agent/frontend/index.html:347"}, "properties": {"repobilityId": "5657094975ed1c81", "scanner": "scanner-primary", "fingerprint": "39cc21c391d1cd9b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "recruiter-agent/frontend/index.html"}, "region": {"startLine": 347}}}]}, {"ruleId": "scanner-51c38f6910a1b79d", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in recruiter-agent/app/server.py:38"}, "properties": {"repobilityId": "4c30a4c26234c992", "scanner": "scanner-primary", "fingerprint": "51c38f6910a1b79d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "recruiter-agent/app/server.py"}, "region": {"startLine": 38}}}]}, {"ruleId": "scanner-9882618a8406987c", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9182334b59402105", "scanner": "scanner-primary", "fingerprint": "9882618a8406987c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ai-native-data-platform/.github/workflows/perf-ci.yml"}, "region": {"startLine": 45}}}]}, {"ruleId": "scanner-9882618a8406987c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5e06c5aa8934f3c6", "scanner": "scanner-primary", "fingerprint": "9882618a8406987c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ai-native-data-platform/.github/workflows/perf-ci.yml"}, "region": {"startLine": 61}}}]}, {"ruleId": "scanner-31c64b86c2689981", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8d1a02e1704e5e57", "scanner": "scanner-primary", "fingerprint": "31c64b86c2689981", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ai-native-data-platform/.github/workflows/eval-gates.yml"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-31c64b86c2689981", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b1de04061b6bd90f", "scanner": "scanner-primary", "fingerprint": "31c64b86c2689981", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ai-native-data-platform/.github/workflows/eval-gates.yml"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-31c64b86c2689981", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2f70074930967a9c", "scanner": "scanner-primary", "fingerprint": "31c64b86c2689981", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ai-native-data-platform/.github/workflows/eval-gates.yml"}, "region": {"startLine": 71}}}]}, {"ruleId": "scanner-31c64b86c2689981", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2f70074930967a9c", "scanner": "scanner-primary", "fingerprint": "31c64b86c2689981", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ai-native-data-platform/.github/workflows/eval-gates.yml"}, "region": {"startLine": 78}}}]}, {"ruleId": "scanner-057651efa21d8acb", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0b74af15b5f1fce5", "scanner": "scanner-primary", "fingerprint": "057651efa21d8acb", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ai-native-data-platform/.github/workflows/loadtest.yml"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-057651efa21d8acb", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a6c04bcf4eebeab2", "scanner": "scanner-primary", "fingerprint": "057651efa21d8acb", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ai-native-data-platform/.github/workflows/loadtest.yml"}, "region": {"startLine": 50}}}]}, {"ruleId": "scanner-2c7df2310f9a3ed4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "91ef5334694a43a1", "scanner": "scanner-primary", "fingerprint": "2c7df2310f9a3ed4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Claude Code Architect Certification/.github/workflows/claude-review.yml"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-671e23c40699188e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "60b41164634e4c17", "scanner": "scanner-primary", "fingerprint": "671e23c40699188e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "recruiter-agent/.github/workflows/eval.yml"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-671e23c40699188e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "31219798fd58d796", "scanner": "scanner-primary", "fingerprint": "671e23c40699188e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "recruiter-agent/.github/workflows/eval.yml"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-4643702eb442486e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ac82a0cf4ae49263", "scanner": "scanner-primary", "fingerprint": "4643702eb442486e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "recruiter-agent/.github/workflows/deploy.yml"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-4643702eb442486e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ce360d0576bfa9e8", "scanner": "scanner-primary", "fingerprint": "4643702eb442486e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "recruiter-agent/.github/workflows/deploy.yml"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-4643702eb442486e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ac82a0cf4ae49263", "scanner": "scanner-primary", "fingerprint": "4643702eb442486e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "recruiter-agent/.github/workflows/deploy.yml"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-4643702eb442486e", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4e258f4cd6bcd135", "scanner": "scanner-primary", "fingerprint": "4643702eb442486e", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "recruiter-agent/.github/workflows/deploy.yml"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "d231822da92beb2f", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-47cae0f7be9d3511", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: agent-observability/frontend/package.json"}, "properties": {"repobilityId": "c863fe19c8cb583b", "scanner": "scanner-primary", "fingerprint": "47cae0f7be9d3511", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent-observability/frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "037aa96dcc4d4756", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "d406760b785653f9", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "02b327109fde9c1e", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "warning", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "4bde16e5164fdf7f", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "e664974b23d39664", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "9733e70cabb98a89", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "f5becbbc3a677fd4", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-7cc6a9de62360d87", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: AIEngineering workflow toolkit/AGENTS.md"}, "properties": {"repobilityId": "a309327ac4765b44", "scanner": "scanner-primary", "fingerprint": "7cc6a9de62360d87", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agents_md"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "AIEngineering workflow toolkit/AGENTS.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bf1c6064e9e98175", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: AIEngineering workflow toolkit/.claude/settings.json"}, "properties": {"repobilityId": "7403aa0bcaae14d3", "scanner": "scanner-primary", "fingerprint": "bf1c6064e9e98175", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "AIEngineering workflow toolkit/.claude/settings.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-abd2a003586d6d0d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: AIEngineering workflow toolkit/.claude/settings.local.json"}, "properties": {"repobilityId": "6fa06a4d4affa945", "scanner": "scanner-primary", "fingerprint": "abd2a003586d6d0d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "AIEngineering workflow toolkit/.claude/settings.local.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1d164dc461a70938", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: agent-observability/.claude/settings.local.json"}, "properties": {"repobilityId": "57b0c5a1b8ec62b7", "scanner": "scanner-primary", "fingerprint": "1d164dc461a70938", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent-observability/.claude/settings.local.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0345723caca63c63", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: Claude Code Architect Certification/.mcp.json"}, "properties": {"repobilityId": "25249ce302caff76", "scanner": "scanner-primary", "fingerprint": "0345723caca63c63", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "mcp_config"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Claude Code Architect Certification/.mcp.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-87b036d8c056a345", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: Claude Code Architect Certification/.claude/settings.local.json"}, "properties": {"repobilityId": "067e938d618234df", "scanner": "scanner-primary", "fingerprint": "87b036d8c056a345", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Claude Code Architect Certification/.claude/settings.local.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4fded3fb23bf9181", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: Claude Code Architect Certification/.claude/rules/agents.md"}, "properties": {"repobilityId": "bdb0e2a434668464", "scanner": "scanner-primary", "fingerprint": "4fded3fb23bf9181", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Claude Code Architect Certification/.claude/rules/agents.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-13d893dd137b8eeb", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: Claude Code Architect Certification/.claude/commands/review-pr.md"}, "properties": {"repobilityId": "a6ba497dc7e78397", "scanner": "scanner-primary", "fingerprint": "13d893dd137b8eeb", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Claude Code Architect Certification/.claude/commands/review-pr.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-92eb99d52ef25776", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: Claude Code Architect Certification/.claude/commands/run-evals.md"}, "properties": {"repobilityId": "39d28a402ea75b09", "scanner": "scanner-primary", "fingerprint": "92eb99d52ef25776", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Claude Code Architect Certification/.claude/commands/run-evals.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-41400c4642c2f4e6", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: Claude Code Architect Certification/.claude/commands/analyze-ticket.md"}, "properties": {"repobilityId": "95740cc13e399af3", "scanner": "scanner-primary", "fingerprint": "41400c4642c2f4e6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Claude Code Architect Certification/.claude/commands/analyze-ticket.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e1bef2f392d6a1e6", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: Claude Code Architect Certification/.claude/commands/batch-process.md"}, "properties": {"repobilityId": "65729c0c25f3a843", "scanner": "scanner-primary", "fingerprint": "e1bef2f392d6a1e6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Claude Code Architect Certification/.claude/commands/batch-process.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e072a11911d2c3a3", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: recruiter-agent/.claude/settings.local.json"}, "properties": {"repobilityId": "ac284daa2673eb08", "scanner": "scanner-primary", "fingerprint": "e072a11911d2c3a3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "recruiter-agent/.claude/settings.local.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9fdf07f4843ad14a", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 AIEngineering workflow toolkit/main.py:92"}, "properties": {"repobilityId": "7a487b1a2bdf8b5d", "scanner": "scanner-primary", "fingerprint": "9fdf07f4843ad14a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-11db0ff88129115d", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 AIEngineering workflow toolkit/ui/src/api/client.ts:29"}, "properties": {"repobilityId": "d0026374cfbf8344", "scanner": "scanner-primary", "fingerprint": "11db0ff88129115d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-3bf45cc00f6e08e8", "level": "none", "message": {"text": "Commented-code block (5 lines) in AIEngineering workflow toolkit/subagents/architecture_agent.py:9"}, "properties": {"repobilityId": "29a14a71706de6bd", "scanner": "scanner-primary", "fingerprint": "3bf45cc00f6e08e8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-dccca42f07a21d3c", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 AIEngineering workflow toolkit/.claude/hooks/pre_tool_use.py:37"}, "properties": {"repobilityId": "b682c3ac53ff95ef", "scanner": "scanner-primary", "fingerprint": "dccca42f07a21d3c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-6953ee1ddd64f0ac", "level": "none", "message": {"text": "Commented-code block (8 lines) in AIEngineering workflow toolkit/mcp_server/server.py:127"}, "properties": {"repobilityId": "ffe85d6baea22629", "scanner": "scanner-primary", "fingerprint": "6953ee1ddd64f0ac", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-83b242fcce824036", "level": "note", "message": {"text": "Legacy-named symbol `style_review_v1` in AIEngineering workflow toolkit/skills/loader.py:51"}, "properties": {"repobilityId": "8f7bec76d2da0ecf", "scanner": "scanner-primary", "fingerprint": "83b242fcce824036", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-6598fb0000ff790f", "level": "none", "message": {"text": "Commented-code block (5 lines) in agent-observability/frontend/src/api/restClient.ts:9"}, "properties": {"repobilityId": "6c5247000eb7a12d", "scanner": "scanner-primary", "fingerprint": "6598fb0000ff790f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0a73b1f8034b46c8", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 agent-observability/scripts/generate_proto.py:22"}, "properties": {"repobilityId": "b47a2795765c9224", "scanner": "scanner-primary", "fingerprint": "0a73b1f8034b46c8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-9fa76aeca2591903", "level": "note", "message": {"text": "Legacy-named symbol `health_v1` in agent-observability/backend/app/main.py:48"}, "properties": {"repobilityId": "3d5d85c750819b27", "scanner": "scanner-primary", "fingerprint": "9fa76aeca2591903", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-f53a32916b977c42", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 rag-app/frontend.py:26"}, "properties": {"repobilityId": "98a25c3c54210de1", "scanner": "scanner-primary", "fingerprint": "f53a32916b977c42", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-4a1e1cd327168c43", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 ai-native-data-platform/app/eval/scheduler/run.py:57"}, "properties": {"repobilityId": "67f1d28947213dc5", "scanner": "scanner-primary", "fingerprint": "4a1e1cd327168c43", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-7aa99b5fd350fa41", "level": "none", "message": {"text": "Commented-code block (6 lines) in Claude Code Architect Certification/anti_patterns/01_vague_tool_descriptions.py:119"}, "properties": {"repobilityId": "419904b5fb0f0434", "scanner": "scanner-primary", "fingerprint": "7aa99b5fd350fa41", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-867d2adc09002861", "level": "none", "message": {"text": "Commented-code block (5 lines) in Claude Code Architect Certification/anti_patterns/04_vague_confidence_threshold.py:20"}, "properties": {"repobilityId": "7db0632f4059ddf7", "scanner": "scanner-primary", "fingerprint": "867d2adc09002861", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7f6d4ecfbf1e00c3", "level": "none", "message": {"text": "Commented-code block (5 lines) in Claude Code Architect Certification/anti_patterns/02_missing_subagent_context.py:143"}, "properties": {"repobilityId": "34232a2597fb0651", "scanner": "scanner-primary", "fingerprint": "7f6d4ecfbf1e00c3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4cdd5744573fe431", "level": "note", "message": {"text": "Legacy-named symbol `eleven_turbo_v2` in recruiter-agent/benchmark_voice.py:160"}, "properties": {"repobilityId": "df4b3b318f922938", "scanner": "scanner-primary", "fingerprint": "4cdd5744573fe431", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-eac84ba2bf3dc2fa", "level": "none", "message": {"text": "Commented-code block (5 lines) in recruiter-agent/app/voice.py:356"}, "properties": {"repobilityId": "59d7ea01e803c43f", "scanner": "scanner-primary", "fingerprint": "eac84ba2bf3dc2fa", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f7cafa45197dc23c", "level": "note", "message": {"text": "Legacy-named symbol `t_old` in recruiter-agent/eval/compare_versions.py:245"}, "properties": {"repobilityId": "1a7a64d146c4aec6", "scanner": "scanner-primary", "fingerprint": "f7cafa45197dc23c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-fb87f14083523571", "level": "note", "message": {"text": "147 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "3623f1dabebcf193", "scanner": "scanner-primary", "fingerprint": "fb87f14083523571", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "b8bcec12b23b4cd2", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "ee4899a31f877f39", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "8df94f3cb398a130", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "e8dd0b8e020e0d2d", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "1676d0adc2d63348", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "2297f979b696c230", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "ba8163af2ad35dcc", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-76a2f6818267a9a8", "level": "note", "message": {"text": "Near-duplicate function bodies in 8 places"}, "properties": {"repobilityId": "b687cdedebab7d99", "scanner": "scanner-primary", "fingerprint": "76a2f6818267a9a8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "ab971f8b4aaf5220", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "03e53d775f4e6aba", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "3a2786edbdc2017b", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-28f88f46f907009b", "level": "warning", "message": {"text": "Frontend route `/reviews/:id` has no Link/navigate to it \u2014 AIEngineering workflow toolkit/ui/src/App.tsx"}, "properties": {"repobilityId": "9a1aaf8b23a5af41", "scanner": "scanner-primary", "fingerprint": "28f88f46f907009b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-6b3e5d34657fb227", "level": "warning", "message": {"text": "Frontend route `/auth/callback` has no Link/navigate to it \u2014 agent-observability/frontend/src/App.tsx"}, "properties": {"repobilityId": "616e44a3b57bcff7", "scanner": "scanner-primary", "fingerprint": "6b3e5d34657fb227", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-e64fa12c6239bf4a", "level": "error", "message": {"text": "FastAPI POST `submit_review` without auth dependency \u2014 AIEngineering workflow toolkit/api/app.py:68"}, "properties": {"repobilityId": "3f86723b06a4b328", "scanner": "scanner-primary", "fingerprint": "e64fa12c6239bf4a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "AIEngineering workflow toolkit/api/app.py"}, "region": {"startLine": 68}}}]}, {"ruleId": "scanner-34ab99c38fb3a735", "level": "error", "message": {"text": "FastAPI POST `create_user` without auth dependency \u2014 agent-observability/backend/app/routers/admin.py:74"}, "properties": {"repobilityId": "37c3b72b0830d9b3", "scanner": "scanner-primary", "fingerprint": "34ab99c38fb3a735", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent-observability/backend/app/routers/admin.py"}, "region": {"startLine": 74}}}]}, {"ruleId": "scanner-319b0133b66def89", "level": "error", "message": {"text": "FastAPI PATCH `update_user` without auth dependency \u2014 agent-observability/backend/app/routers/admin.py:97"}, "properties": {"repobilityId": "a865339298f78646", "scanner": "scanner-primary", "fingerprint": "319b0133b66def89", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent-observability/backend/app/routers/admin.py"}, "region": {"startLine": 97}}}]}, {"ruleId": "scanner-81bab7672ee9606e", "level": "error", "message": {"text": "FastAPI POST `revoke_sessions` without auth dependency \u2014 agent-observability/backend/app/routers/admin.py:131"}, "properties": {"repobilityId": "dc4984d32e8f05ae", "scanner": "scanner-primary", "fingerprint": "81bab7672ee9606e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "agent-observability/backend/app/routers/admin.py"}, "region": {"startLine": 131}}}]}, {"ruleId": "scanner-864c54e6eb6db76b", "level": "error", "message": {"text": "FastAPI POST `investigate` without auth dependency \u2014 Claude Code Architect Certification/api/app.py:26"}, "properties": {"repobilityId": "0cc0fc32f9e840b4", "scanner": "scanner-primary", "fingerprint": "864c54e6eb6db76b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Claude Code Architect Certification/api/app.py"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-d737ec535e4193b3", "level": "error", "message": {"text": "FastAPI POST `chat_endpoint` without auth dependency \u2014 recruiter-agent/app/server.py:96"}, "properties": {"repobilityId": "5447ebf23fbc5288", "scanner": "scanner-primary", "fingerprint": "d737ec535e4193b3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "recruiter-agent/app/server.py"}, "region": {"startLine": 96}}}]}, {"ruleId": "scanner-1c0278cd2dfdcc22", "level": "error", "message": {"text": "FastAPI POST `mcp_call_endpoint` without auth dependency \u2014 recruiter-agent/app/server.py:228"}, "properties": {"repobilityId": "ed3ff3345b42525c", "scanner": "scanner-primary", "fingerprint": "1c0278cd2dfdcc22", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "recruiter-agent/app/server.py"}, "region": {"startLine": 228}}}]}, {"ruleId": "scanner-74635ed8e80c0bf1", "level": "error", "message": {"text": "FastAPI POST `a2a_validate_endpoint` without auth dependency \u2014 recruiter-agent/app/server.py:261"}, "properties": {"repobilityId": "85f1fb7d19b0bf9d", "scanner": "scanner-primary", "fingerprint": "74635ed8e80c0bf1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "recruiter-agent/app/server.py"}, "region": {"startLine": 261}}}]}, {"ruleId": "scanner-a7819b78b73d9b12", "level": "error", "message": {"text": "FastAPI POST `webrtc_offer_endpoint` without auth dependency \u2014 recruiter-agent/app/server.py:305"}, "properties": {"repobilityId": "6edaa6e4e71cb394", "scanner": "scanner-primary", "fingerprint": "a7819b78b73d9b12", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "recruiter-agent/app/server.py"}, "region": {"startLine": 305}}}]}, {"ruleId": "scanner-337dbf9863bc6f31", "level": "error", "message": {"text": "FastAPI DELETE `webrtc_cleanup_endpoint` without auth dependency \u2014 recruiter-agent/app/server.py:327"}, "properties": {"repobilityId": "acc7891a0af32978", "scanner": "scanner-primary", "fingerprint": "337dbf9863bc6f31", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "recruiter-agent/app/server.py"}, "region": {"startLine": 327}}}]}, {"ruleId": "scanner-8cc109f716156ca7", "level": "error", "message": {"text": "FastAPI POST `create_campaign_endpoint` without auth dependency \u2014 recruiter-agent/app/server.py:345"}, "properties": {"repobilityId": "233be38547bc7684", "scanner": "scanner-primary", "fingerprint": "8cc109f716156ca7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "recruiter-agent/app/server.py"}, "region": {"startLine": 345}}}]}, {"ruleId": "scanner-ac23b53fa2d40d88", "level": "error", "message": {"text": "FastAPI POST `start_campaign_endpoint` without auth dependency \u2014 recruiter-agent/app/server.py:363"}, "properties": {"repobilityId": "975c477572a0e895", "scanner": "scanner-primary", "fingerprint": "ac23b53fa2d40d88", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "recruiter-agent/app/server.py"}, "region": {"startLine": 363}}}]}, {"ruleId": "scanner-046c325606842527", "level": "error", "message": {"text": "FastAPI POST `pause_campaign_endpoint` without auth dependency \u2014 recruiter-agent/app/server.py:369"}, "properties": {"repobilityId": "3c1218e04d9a1cdb", "scanner": "scanner-primary", "fingerprint": "046c325606842527", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "recruiter-agent/app/server.py"}, "region": {"startLine": 369}}}]}, {"ruleId": "scanner-ccc76bc62aa3e8d9", "level": "error", "message": {"text": "FastAPI POST `opt_out_endpoint` without auth dependency \u2014 recruiter-agent/app/server.py:384"}, "properties": {"repobilityId": "59d3c613ebe13178", "scanner": "scanner-primary", "fingerprint": "ccc76bc62aa3e8d9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "recruiter-agent/app/server.py"}, "region": {"startLine": 384}}}]}, {"ruleId": "scanner-6c23cd758613e461", "level": "error", "message": {"text": "FastAPI POST `outbound_callback_endpoint` without auth dependency \u2014 recruiter-agent/app/server.py:391"}, "properties": {"repobilityId": "ad24ba8643dfeb76", "scanner": "scanner-primary", "fingerprint": "6c23cd758613e461", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "recruiter-agent/app/server.py"}, "region": {"startLine": 391}}}]}, {"ruleId": "scanner-c36682309c49b8d9", "level": "error", "message": {"text": "FastAPI POST `outbound_twiml_endpoint` without auth dependency \u2014 recruiter-agent/app/server.py:401"}, "properties": {"repobilityId": "c00349239c4fd20e", "scanner": "scanner-primary", "fingerprint": "c36682309c49b8d9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "recruiter-agent/app/server.py"}, "region": {"startLine": 401}}}]}, {"ruleId": "scanner-faa3fb8af9f1485f", "level": "error", "message": {"text": "FastAPI POST `phone_twiml_endpoint` without auth dependency \u2014 recruiter-agent/app/server.py:422"}, "properties": {"repobilityId": "29dc2d2673eb146d", "scanner": "scanner-primary", "fingerprint": "faa3fb8af9f1485f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "recruiter-agent/app/server.py"}, "region": {"startLine": 422}}}]}, {"ruleId": "scanner-220ebcfbe1af356c", "level": "note", "message": {"text": "Unused endpoint: POST /api/reviews"}, "properties": {"repobilityId": "fbbda9b9227956c7", "scanner": "scanner-primary", "fingerprint": "220ebcfbe1af356c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8cbf6af853ff55b8", "level": "note", "message": {"text": "Unused endpoint: GET /api/reviews"}, "properties": {"repobilityId": "c2ed9cfa77e498ad", "scanner": "scanner-primary", "fingerprint": "8cbf6af853ff55b8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a6680f1b59dcb1ed", "level": "note", "message": {"text": "Unused endpoint: GET /api/reviews/{review_id}"}, "properties": {"repobilityId": "963c018e20a5c859", "scanner": "scanner-primary", "fingerprint": "a6680f1b59dcb1ed", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3b37265900e79a8a", "level": "note", "message": {"text": "Unused endpoint: GET /api/stats"}, "properties": {"repobilityId": "70e14f5c54cc7081", "scanner": "scanner-primary", "fingerprint": "3b37265900e79a8a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5fa57b0705efe6d8", "level": "note", "message": {"text": "Unused endpoint: GET /api/eval/latest"}, "properties": {"repobilityId": "200f7229bf691c98", "scanner": "scanner-primary", "fingerprint": "5fa57b0705efe6d8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-308b6e56c5334f41", "level": "note", "message": {"text": "Unused endpoint: GET /api/eval/history"}, "properties": {"repobilityId": "462675389616a1ab", "scanner": "scanner-primary", "fingerprint": "308b6e56c5334f41", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "8a926628b8d789e8", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1b1d5926fda286fa", "level": "note", "message": {"text": "Unused endpoint: GET /{full_path:path}"}, "properties": {"repobilityId": "245b925b3b8ed50d", "scanner": "scanner-primary", "fingerprint": "1b1d5926fda286fa", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4756b4c4da7d2088", "level": "note", "message": {"text": "Unused endpoint: GET /api/health"}, "properties": {"repobilityId": "a3a48550e78e83bf", "scanner": "scanner-primary", "fingerprint": "4756b4c4da7d2088", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d345fa90f5de3745", "level": "note", "message": {"text": "Unused endpoint: GET /authorize"}, "properties": {"repobilityId": "4c4b81945f9ee90d", "scanner": "scanner-primary", "fingerprint": "d345fa90f5de3745", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6c4452e1c08b3191", "level": "note", "message": {"text": "Unused endpoint: POST /callback"}, "properties": {"repobilityId": "abeaf0c98f4f054f", "scanner": "scanner-primary", "fingerprint": "6c4452e1c08b3191", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-99fc36db98c134ce", "level": "note", "message": {"text": "Unused endpoint: POST /logout"}, "properties": {"repobilityId": "e521206817da0f66", "scanner": "scanner-primary", "fingerprint": "99fc36db98c134ce", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7a009b1a56794f45", "level": "note", "message": {"text": "Unused endpoint: POST /"}, "properties": {"repobilityId": "ace74927aadd9b05", "scanner": "scanner-primary", "fingerprint": "7a009b1a56794f45", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1d944294f9a29ca0", "level": "note", "message": {"text": "Unused endpoint: POST /{run_id}/results"}, "properties": {"repobilityId": "eacef4943ed6133a", "scanner": "scanner-primary", "fingerprint": "1d944294f9a29ca0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-87f033efdf5491d6", "level": "note", "message": {"text": "Unused endpoint: DELETE /{run_id}"}, "properties": {"repobilityId": "b0daf8f4a156cdb5", "scanner": "scanner-primary", "fingerprint": "87f033efdf5491d6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0cfd14d6d4f9945c", "level": "note", "message": {"text": "Unused endpoint: GET /{trace_id}"}, "properties": {"repobilityId": "561cf7e66c4feac8", "scanner": "scanner-primary", "fingerprint": "0cfd14d6d4f9945c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-841e50bf821e4158", "level": "note", "message": {"text": "Unused endpoint: GET /users"}, "properties": {"repobilityId": "7c0a5911ed19b601", "scanner": "scanner-primary", "fingerprint": "841e50bf821e4158", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1bca8100a44f7f25", "level": "note", "message": {"text": "Unused endpoint: POST /users"}, "properties": {"repobilityId": "07b77783765e2f0f", "scanner": "scanner-primary", "fingerprint": "1bca8100a44f7f25", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cc679d62b533e7b6", "level": "note", "message": {"text": "Unused endpoint: PATCH /users/{user_id}"}, "properties": {"repobilityId": "118ac21b30b1ff69", "scanner": "scanner-primary", "fingerprint": "cc679d62b533e7b6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-03ee6e65afee8ef1", "level": "note", "message": {"text": "Unused endpoint: POST /users/{user_id}/revoke-sessions"}, "properties": {"repobilityId": "76579ed10308c3e4", "scanner": "scanner-primary", "fingerprint": "03ee6e65afee8ef1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-00d297d86aa253fe", "level": "note", "message": {"text": "Unused endpoint: GET /audit"}, "properties": {"repobilityId": "9640259ef675dcf4", "scanner": "scanner-primary", "fingerprint": "00d297d86aa253fe", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8e1fadad2500f063", "level": "note", "message": {"text": "Unused endpoint: POST /ask"}, "properties": {"repobilityId": "8850dae33961d07c", "scanner": "scanner-primary", "fingerprint": "8e1fadad2500f063", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-07c8058844c53ae8", "level": "note", "message": {"text": "Unused endpoint: POST /act"}, "properties": {"repobilityId": "4bd743df2be9067f", "scanner": "scanner-primary", "fingerprint": "07c8058844c53ae8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-08fe27b8bc6050ae", "level": "note", "message": {"text": "Unused endpoint: POST /ingest/transcript"}, "properties": {"repobilityId": "f560d206e8b13419", "scanner": "scanner-primary", "fingerprint": "08fe27b8bc6050ae", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7909a52cb9cfec36", "level": "note", "message": {"text": "Unused endpoint: POST /ingest/image"}, "properties": {"repobilityId": "ea4a38b6dd32ba9f", "scanner": "scanner-primary", "fingerprint": "7909a52cb9cfec36", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d3f92ef9f2a961f3", "level": "note", "message": {"text": "Unused endpoint: POST /query/natural-language"}, "properties": {"repobilityId": "cb5549980cad0d87", "scanner": "scanner-primary", "fingerprint": "d3f92ef9f2a961f3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-520d4d671fb65050", "level": "note", "message": {"text": "Unused endpoint: POST /investigate"}, "properties": {"repobilityId": "2f3a60e3c0b948a5", "scanner": "scanner-primary", "fingerprint": "520d4d671fb65050", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-91786ec9e40e27ca", "level": "note", "message": {"text": "Unused endpoint: GET /{path:path}"}, "properties": {"repobilityId": "45617ebeacf6a277", "scanner": "scanner-primary", "fingerprint": "91786ec9e40e27ca", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cff8da5fbc19c76d", "level": "note", "message": {"text": "Unused endpoint: POST /chat"}, "properties": {"repobilityId": "05ab62acf0e828b5", "scanner": "scanner-primary", "fingerprint": "cff8da5fbc19c76d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-066d9d6875914444", "level": "note", "message": {"text": "Unused endpoint: GET /mcp/tools"}, "properties": {"repobilityId": "de52fb9c36dd1cce", "scanner": "scanner-primary", "fingerprint": "066d9d6875914444", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c8cd893d1050b73f", "level": "note", "message": {"text": "Unused endpoint: POST /mcp/call"}, "properties": {"repobilityId": "72647ccffecf31bc", "scanner": "scanner-primary", "fingerprint": "c8cd893d1050b73f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-041bbc7191989675", "level": "note", "message": {"text": "Unused endpoint: POST /a2a/validate"}, "properties": {"repobilityId": "ef6a9b7ee810131e", "scanner": "scanner-primary", "fingerprint": "041bbc7191989675", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-30f051c71453cec2", "level": "note", "message": {"text": "Unused endpoint: POST /webrtc/offer"}, "properties": {"repobilityId": "4f6bfbb007fcdda3", "scanner": "scanner-primary", "fingerprint": "30f051c71453cec2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b1b9ab229d25182a", "level": "note", "message": {"text": "Unused endpoint: DELETE /webrtc/{pc_id}"}, "properties": {"repobilityId": "78f6b66663d6c2d3", "scanner": "scanner-primary", "fingerprint": "b1b9ab229d25182a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-52b054791efb43e7", "level": "note", "message": {"text": "Unused endpoint: POST /outbound/campaign"}, "properties": {"repobilityId": "06d106642118e4fc", "scanner": "scanner-primary", "fingerprint": "52b054791efb43e7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-04761c42b0ec3c86", "level": "note", "message": {"text": "Unused endpoint: POST /outbound/campaign/{campaign_id}/start"}, "properties": {"repobilityId": "b4a93841eddd4a33", "scanner": "scanner-primary", "fingerprint": "04761c42b0ec3c86", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5cf69f1688cb19aa", "level": "note", "message": {"text": "Unused endpoint: POST /outbound/campaign/{campaign_id}/pause"}, "properties": {"repobilityId": "5b6021e22aa5e65d", "scanner": "scanner-primary", "fingerprint": "5cf69f1688cb19aa", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5238a1f39a5fbf7f", "level": "note", "message": {"text": "Unused endpoint: GET /outbound/campaign/{campaign_id}"}, "properties": {"repobilityId": "5a12f4b4d9c95dd9", "scanner": "scanner-primary", "fingerprint": "5238a1f39a5fbf7f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8f3676c4932766b3", "level": "note", "message": {"text": "Unused endpoint: POST /outbound/opt-out"}, "properties": {"repobilityId": "4badf17c0386eb90", "scanner": "scanner-primary", "fingerprint": "8f3676c4932766b3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7726ec43eb87b7b1", "level": "note", "message": {"text": "Unused endpoint: POST /outbound/callback"}, "properties": {"repobilityId": "9f037c2134a61279", "scanner": "scanner-primary", "fingerprint": "7726ec43eb87b7b1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8149b05484be2fd4", "level": "note", "message": {"text": "Unused endpoint: POST /phone/twiml/outbound"}, "properties": {"repobilityId": "4c8d9cd0b3d48109", "scanner": "scanner-primary", "fingerprint": "8149b05484be2fd4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7df9d677813ec3c7", "level": "note", "message": {"text": "Unused endpoint: GET /outbound/status"}, "properties": {"repobilityId": "c1500f00b6f4b4d7", "scanner": "scanner-primary", "fingerprint": "7df9d677813ec3c7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8eda29045649f743", "level": "note", "message": {"text": "Unused endpoint: POST /phone/twiml"}, "properties": {"repobilityId": "169a7f3ce88af064", "scanner": "scanner-primary", "fingerprint": "8eda29045649f743", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-deaaea4281e57678", "level": "note", "message": {"text": "Unused endpoint: GET /a2a/summary/{session_id}"}, "properties": {"repobilityId": "ba44081c1cf72f9c", "scanner": "scanner-primary", "fingerprint": "deaaea4281e57678", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8158bd1cc68feffa", "level": "note", "message": {"text": "Unused endpoint: GET /session/{session_id}/summary"}, "properties": {"repobilityId": "587d761f19c30758", "scanner": "scanner-primary", "fingerprint": "8158bd1cc68feffa", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c059f57186114027", "level": "note", "message": {"text": "Unused endpoint: POST /auth/logout"}, "properties": {"repobilityId": "dd5ecf80614e45b5", "scanner": "scanner-primary", "fingerprint": "c059f57186114027", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6c9282666b199ce9", "level": "note", "message": {"text": "Unused endpoint: GET /admin/audit"}, "properties": {"repobilityId": "429bfe09e5a9cb15", "scanner": "scanner-primary", "fingerprint": "6c9282666b199ce9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}