{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-5cd7620de784d1f3", "name": "Possibly dead Python function: trigger_phrase_index", "shortDescription": {"text": "Possibly dead Python function: trigger_phrase_index"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b3ab960cef8cf0c2", "name": "Possibly dead Python function: sampler", "shortDescription": {"text": "Possibly dead Python function: sampler"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ade3230ef6400cba", "name": "Possibly dead Python function: persist_session_audio", "shortDescription": {"text": "Possibly dead Python function: persist_session_audio"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cf370fa6b3551d90", "name": "Possibly dead Python function: list_voices", "shortDescription": {"text": "Possibly dead Python function: list_voices"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-61351068b019671e", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/imagination_engine/web/intake.html:320", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/imagination_engine/web/intake.html:320"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5c5a83f6e0142eec", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/imagination_engine/web/record.html:215", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/imagination_engine/web/record.html:215"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-936ad6a1f378cd2c", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/imagination_engine/web/build.html:78", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/imagination_engine/web/build.html:78"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 359 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 30 placeholder/mock markers across 11 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing ci. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-31fee5cee7b039d1", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/download_system_voices.py:80", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/download_system_voices.py:80"}, "fullDescription": {"text": "`urllib.request.urlopen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-34507ee4b5dfe50f", "name": "Commented-code block (7 lines) in scripts/build_training_data.py:163", "shortDescription": {"text": "Commented-code block (7 lines) in scripts/build_training_data.py:163"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b23ed4841f70fdff", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/apple_setup.py:90", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/apple_setup.py:90"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2ccad6b5a1555d3c", "name": "Commented-code block (5 lines) in scripts/test_rag_corpus.py:25", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/test_rag_corpus.py:25"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-04ba2e6ae268d759", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/train_voice.py:36", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/train_voice.py:36"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1e546bba79f1a2ab", "name": "Commented-code block (5 lines) in scripts/analyze_v2_scripts.py:248", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/analyze_v2_scripts.py:248"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9c362725579a9123", "name": "Commented-code block (8 lines) in src/imagination_engine/config.py:34", "shortDescription": {"text": "Commented-code block (8 lines) in src/imagination_engine/config.py:34"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2786f039e2315ca1", "name": "Network/subprocess call without timeout or try/except \u2014 src/imagination_engine/server.py:319", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 src/imagination_engine/server.py:319"}, "fullDescription": {"text": "`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-00c99054f3b5b7c3", "name": "Commented-code block (5 lines) in src/imagination_engine/generator.py:606", "shortDescription": {"text": "Commented-code block (5 lines) in src/imagination_engine/generator.py:606"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-18d698374e602519", "name": "Network/subprocess call without timeout or try/except \u2014 src/imagination_engine/tts.py:68", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 src/imagination_engine/tts.py:68"}, "fullDescription": {"text": "`urllib.request.urlretrieve(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nsrc/imagination_engine/intake.py:to_dict, src/imagination_engine/intake.py:to_dict\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nsrc/imagination_engine/rag.py:embed, src/imagination_engine/rag.py:embed, src/imagination_engine/rag.py:embed\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-48bb869f7a04a532", "name": "FastAPI POST `generate` without auth dependency \u2014 src/imagination_engine/server.py:201", "shortDescription": {"text": "FastAPI POST `generate` without auth dependency \u2014 src/imagination_engine/server.py:201"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bb4bd6b786741e48", "name": "FastAPI POST `speak` without auth dependency \u2014 src/imagination_engine/server.py:212", "shortDescription": {"text": "FastAPI POST `speak` without auth dependency \u2014 src/imagination_engine/server.py:212"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5036cb909414a6a1", "name": "FastAPI POST `record_save` without auth dependency \u2014 src/imagination_engine/server.py:267", "shortDescription": {"text": "FastAPI POST `record_save` without auth dependency \u2014 src/imagination_engine/server.py:267"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-edf8aa846211adc9", "name": "FastAPI DELETE `record_delete` without auth dependency \u2014 src/imagination_engine/server.py:286", "shortDescription": {"text": "FastAPI DELETE `record_delete` without auth dependency \u2014 src/imagination_engine/server.py:286"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8474d0d08b3146e4", "name": "FastAPI POST `record_train` without auth dependency \u2014 src/imagination_engine/server.py:302", "shortDescription": {"text": "FastAPI POST `record_train` without auth dependency \u2014 src/imagination_engine/server.py:302"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-90d5db57aba30a9d", "name": "FastAPI POST `intake_start` without auth dependency \u2014 src/imagination_engine/server.py:348", "shortDescription": {"text": "FastAPI POST `intake_start` without auth dependency \u2014 src/imagination_engine/server.py:348"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-adfe94464792bdb7", "name": "FastAPI POST `intake_turn` without auth dependency \u2014 src/imagination_engine/server.py:356", "shortDescription": {"text": "FastAPI POST `intake_turn` without auth dependency \u2014 src/imagination_engine/server.py:356"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-53c926349e4064f5", "name": "FastAPI POST `intake_generate` without auth dependency \u2014 src/imagination_engine/server.py:399", "shortDescription": {"text": "FastAPI POST `intake_generate` without auth dependency \u2014 src/imagination_engine/server.py:399"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2df198eb592bf634", "name": "FastAPI POST `intake_reflect` without auth dependency \u2014 src/imagination_engine/server.py:521", "shortDescription": {"text": "FastAPI POST `intake_reflect` without auth dependency \u2014 src/imagination_engine/server.py:521"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-26196f07736b8f2f", "name": "FastAPI POST `companion_turn` without auth dependency \u2014 src/imagination_engine/server.py:560", "shortDescription": {"text": "FastAPI POST `companion_turn` without auth dependency \u2014 src/imagination_engine/server.py:560"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-59e1568bf3e251d2", "name": "FastAPI POST `ask_index` without auth dependency \u2014 src/imagination_engine/server.py:607", "shortDescription": {"text": "FastAPI POST `ask_index` without auth dependency \u2014 src/imagination_engine/server.py:607"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-dcffd08cf3f588f5", "name": "FastAPI POST `ask_query` without auth dependency \u2014 src/imagination_engine/server.py:617", "shortDescription": {"text": "FastAPI POST `ask_query` without auth dependency \u2014 src/imagination_engine/server.py:617"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-eb424268118a5229", "name": "FastAPI POST `utility_run` without auth dependency \u2014 src/imagination_engine/server.py:677", "shortDescription": {"text": "FastAPI POST `utility_run` without auth dependency \u2014 src/imagination_engine/server.py:677"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-89a7e7ed6683acbf", "name": "FastAPI POST `build_create` without auth dependency \u2014 src/imagination_engine/server.py:735", "shortDescription": {"text": "FastAPI POST `build_create` without auth dependency \u2014 src/imagination_engine/server.py:735"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ed9a0f90c8a6bf92", "name": "FastAPI POST `build_ask` without auth dependency \u2014 src/imagination_engine/server.py:771", "shortDescription": {"text": "FastAPI POST `build_ask` without auth dependency \u2014 src/imagination_engine/server.py:771"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`src/imagination_engine/server.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-da49fd123cc95586", "name": "Unused endpoint: GET /welcome", "shortDescription": {"text": "Unused endpoint: GET /welcome"}, "fullDescription": {"text": "`src/imagination_engine/server.py` declares `GET /welcome` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5ff952867cb69636", "name": "Unused endpoint: GET /welcome/state", "shortDescription": {"text": "Unused endpoint: GET /welcome/state"}, "fullDescription": {"text": "`src/imagination_engine/server.py` declares `GET /welcome/state` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-10933152477dd941", "name": "Unused endpoint: GET /voices/options", "shortDescription": {"text": "Unused endpoint: GET /voices/options"}, "fullDescription": {"text": "`src/imagination_engine/server.py` declares `GET /voices/options` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c1493c9515919a8f", "name": "Unused endpoint: GET /dev", "shortDescription": {"text": "Unused endpoint: GET /dev"}, "fullDescription": {"text": "`src/imagination_engine/server.py` declares `GET /dev` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-970eb92d6ec2bfaa", "name": "Unused endpoint: POST /generate", "shortDescription": {"text": "Unused endpoint: POST /generate"}, "fullDescription": {"text": "`src/imagination_engine/server.py` declares `POST /generate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cc05e2496e726a3a", "name": "Unused endpoint: POST /speak", "shortDescription": {"text": "Unused endpoint: POST /speak"}, "fullDescription": {"text": "`src/imagination_engine/server.py` declares `POST /speak` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-863cb2066f0ce32d", "name": "Unused endpoint: GET /record", "shortDescription": {"text": "Unused endpoint: GET /record"}, "fullDescription": {"text": "`src/imagination_engine/server.py` declares `GET /record` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-809052f1b7649a8f", "name": "Unused endpoint: GET /record/speakers", "shortDescription": {"text": "Unused endpoint: GET /record/speakers"}, "fullDescription": {"text": "`src/imagination_engine/server.py` declares `GET /record/speakers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b5a8c678c3b54377", "name": "Unused endpoint: GET /record/sentences", "shortDescription": {"text": "Unused endpoint: GET /record/sentences"}, "fullDescription": {"text": "`src/imagination_engine/server.py` declares `GET /record/sentences` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-84dc13876717ec1a", "name": "Unused endpoint: GET /record/progress/{speaker_id}", "shortDescription": {"text": "Unused endpoint: GET /record/progress/{speaker_id}"}, "fullDescription": {"text": "`src/imagination_engine/server.py` declares `GET /record/progress/{speaker_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7991985d62f88867", "name": "Unused endpoint: POST /record/save/{speaker_id}/{sentence_id}", "shortDescription": {"text": "Unused endpoint: POST /record/save/{speaker_id}/{sentence_id}"}, "fullDescription": {"text": "`src/imagination_engine/server.py` declares `POST /record/save/{speaker_id}/{sentence_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9bdee1e209b20616", "name": "Unused endpoint: DELETE /record/save/{speaker_id}/{sentence_id}", "shortDescription": {"text": "Unused endpoint: DELETE /record/save/{speaker_id}/{sentence_id}"}, "fullDescription": {"text": "`src/imagination_engine/server.py` declares `DELETE /record/save/{speaker_id}/{sentence_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-396df4280cbb86f6", "name": "Unused endpoint: POST /record/train/{speaker_id}", "shortDescription": {"text": "Unused endpoint: POST /record/train/{speaker_id}"}, "fullDescription": {"text": "`src/imagination_engine/server.py` declares `POST /record/train/{speaker_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-601e77cadf2a79e6", "name": "Unused endpoint: GET /record/train/{speaker_id}/status", "shortDescription": {"text": "Unused endpoint: GET /record/train/{speaker_id}/status"}, "fullDescription": {"text": "`src/imagination_engine/server.py` declares `GET /record/train/{speaker_id}/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ddc8a6e0803ad038", "name": "Unused endpoint: GET /intake", "shortDescription": {"text": "Unused endpoint: GET /intake"}, "fullDescription": {"text": "`src/imagination_engine/server.py` declares `GET /intake` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-301f6cdf9f8351f0", "name": "Unused endpoint: POST /intake/start", "shortDescription": {"text": "Unused endpoint: POST /intake/start"}, "fullDescription": {"text": "`src/imagination_engine/server.py` declares `POST /intake/start` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-05e60da00500f638", "name": "Unused endpoint: POST /intake/turn", "shortDescription": {"text": "Unused endpoint: POST /intake/turn"}, "fullDescription": {"text": "`src/imagination_engine/server.py` declares `POST /intake/turn` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c941fdfa8576f80c", "name": "Unused endpoint: GET /intake/{session_id}", "shortDescription": {"text": "Unused endpoint: GET /intake/{session_id}"}, "fullDescription": {"text": "`src/imagination_engine/server.py` declares `GET /intake/{session_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-20ce5b552db7a683", "name": "Unused endpoint: POST /intake/{session_id}/generate", "shortDescription": {"text": "Unused endpoint: POST /intake/{session_id}/generate"}, "fullDescription": {"text": "`src/imagination_engine/server.py` declares `POST /intake/{session_id}/generate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cc65de2ca645df45", "name": "Unused endpoint: GET /intake/{session_id}/download", "shortDescription": {"text": "Unused endpoint: GET /intake/{session_id}/download"}, "fullDescription": {"text": "`src/imagination_engine/server.py` declares `GET /intake/{session_id}/download` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-98e98b52722f7f50", "name": "Unused endpoint: GET /intake/{session_id}/status", "shortDescription": {"text": "Unused endpoint: GET /intake/{session_id}/status"}, "fullDescription": {"text": "`src/imagination_engine/server.py` declares `GET /intake/{session_id}/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e1c7d63b0e9c5cbe", "name": "Unused endpoint: POST /intake/{session_id}/reflect", "shortDescription": {"text": "Unused endpoint: POST /intake/{session_id}/reflect"}, "fullDescription": {"text": "`src/imagination_engine/server.py` declares `POST /intake/{session_id}/reflect` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-41a6de33665e35ff", "name": "Unused endpoint: GET /companion", "shortDescription": {"text": "Unused endpoint: GET /companion"}, "fullDescription": {"text": "`src/imagination_engine/server.py` declares `GET /companion` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cd293beb46e1a289", "name": "Unused endpoint: POST /companion/turn", "shortDescription": {"text": "Unused endpoint: POST /companion/turn"}, "fullDescription": {"text": "`src/imagination_engine/server.py` declares `POST /companion/turn` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-445f4be0725a091c", "name": "Unused endpoint: GET /ask", "shortDescription": {"text": "Unused endpoint: GET /ask"}, "fullDescription": {"text": "`src/imagination_engine/server.py` declares `GET /ask` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9c2d35d2b45ffa0d", "name": "Unused endpoint: POST /ask/index", "shortDescription": {"text": "Unused endpoint: POST /ask/index"}, "fullDescription": {"text": "`src/imagination_engine/server.py` declares `POST /ask/index` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c3cc0fc1c88aa6e2", "name": "Unused endpoint: POST /ask/query", "shortDescription": {"text": "Unused endpoint: POST /ask/query"}, "fullDescription": {"text": "`src/imagination_engine/server.py` declares `POST /ask/query` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1d8200bc5dbee699", "name": "Unused endpoint: GET /utility", "shortDescription": {"text": "Unused endpoint: GET /utility"}, "fullDescription": {"text": "`src/imagination_engine/server.py` declares `GET /utility` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a366624527fb74ae", "name": "Unused endpoint: GET /utility/tasks", "shortDescription": {"text": "Unused endpoint: GET /utility/tasks"}, "fullDescription": {"text": "`src/imagination_engine/server.py` declares `GET /utility/tasks` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6c119a3375da82f3", "name": "Unused endpoint: POST /utility/run", "shortDescription": {"text": "Unused endpoint: POST /utility/run"}, "fullDescription": {"text": "`src/imagination_engine/server.py` declares `POST /utility/run` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-044fbb8540a664cf", "name": "Unused endpoint: GET /build", "shortDescription": {"text": "Unused endpoint: GET /build"}, "fullDescription": {"text": "`src/imagination_engine/server.py` declares `GET /build` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3410f76b749ca575", "name": "Unused endpoint: GET /build/list", "shortDescription": {"text": "Unused endpoint: GET /build/list"}, "fullDescription": {"text": "`src/imagination_engine/server.py` declares `GET /build/list` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a65a1e620507b245", "name": "Unused endpoint: POST /build/create", "shortDescription": {"text": "Unused endpoint: POST /build/create"}, "fullDescription": {"text": "`src/imagination_engine/server.py` declares `POST /build/create` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-04722a83bed40d69", "name": "Unused endpoint: POST /build/ask", "shortDescription": {"text": "Unused endpoint: POST /build/ask"}, "fullDescription": {"text": "`src/imagination_engine/server.py` declares `POST /build/ask` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/21686"}, "properties": {"repository": "tsonali/hearth", "repoUrl": "https://github.com/tsonali/hearth", "branch": "main"}, "results": [{"ruleId": "scanner-5cd7620de784d1f3", "level": "note", "message": {"text": "Possibly dead Python function: trigger_phrase_index"}, "properties": {"repobilityId": "8b67f515d8756986", "scanner": "scanner-primary", "fingerprint": "5cd7620de784d1f3", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/imagination_engine/scene_bibles.py:168"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b3ab960cef8cf0c2", "level": "note", "message": {"text": "Possibly dead Python function: sampler"}, "properties": {"repobilityId": "42911b5f51e6d4e9", "scanner": "scanner-primary", "fingerprint": "b3ab960cef8cf0c2", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/imagination_engine/inference.py:37"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ade3230ef6400cba", "level": "note", "message": {"text": "Possibly dead Python function: persist_session_audio"}, "properties": {"repobilityId": "c12f37f73d3c1cb6", "scanner": "scanner-primary", "fingerprint": "ade3230ef6400cba", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/imagination_engine/audio.py:64"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cf370fa6b3551d90", "level": "note", "message": {"text": "Possibly dead Python function: list_voices"}, "properties": {"repobilityId": "80e8483a84eef244", "scanner": "scanner-primary", "fingerprint": "cf370fa6b3551d90", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/imagination_engine/tts.py:153"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-61351068b019671e", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/imagination_engine/web/intake.html:320"}, "properties": {"repobilityId": "093925c606d17ca7", "scanner": "scanner-primary", "fingerprint": "61351068b019671e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/imagination_engine/web/intake.html"}, "region": {"startLine": 320}}}]}, {"ruleId": "scanner-5c5a83f6e0142eec", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/imagination_engine/web/record.html:215"}, "properties": {"repobilityId": "0bce8cf4a1223b4e", "scanner": "scanner-primary", "fingerprint": "5c5a83f6e0142eec", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/imagination_engine/web/record.html"}, "region": {"startLine": 215}}}]}, {"ruleId": "scanner-936ad6a1f378cd2c", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/imagination_engine/web/build.html:78"}, "properties": {"repobilityId": "1f4a1120299a596d", "scanner": "scanner-primary", "fingerprint": "936ad6a1f378cd2c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/imagination_engine/web/build.html"}, "region": {"startLine": 78}}}]}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "b560842bd5092c4c", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "173635b0c7aaee62", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "9633a1d0f1588f1d", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "686a7e4e9b7b4cec", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "f75959e2f12ac7bc", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "acccad4b7d72bc15", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-31fee5cee7b039d1", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/download_system_voices.py:80"}, "properties": {"repobilityId": "b016e850f56690a6", "scanner": "scanner-primary", "fingerprint": "31fee5cee7b039d1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-34507ee4b5dfe50f", "level": "none", "message": {"text": "Commented-code block (7 lines) in scripts/build_training_data.py:163"}, "properties": {"repobilityId": "6ef4c6757f0865dc", "scanner": "scanner-primary", "fingerprint": "34507ee4b5dfe50f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b23ed4841f70fdff", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/apple_setup.py:90"}, "properties": {"repobilityId": "ec29aec0d046ad5f", "scanner": "scanner-primary", "fingerprint": "b23ed4841f70fdff", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2ccad6b5a1555d3c", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/test_rag_corpus.py:25"}, "properties": {"repobilityId": "2388ef08d7fc1cd4", "scanner": "scanner-primary", "fingerprint": "2ccad6b5a1555d3c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-04ba2e6ae268d759", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/train_voice.py:36"}, "properties": {"repobilityId": "2b6f964f047250c3", "scanner": "scanner-primary", "fingerprint": "04ba2e6ae268d759", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-1e546bba79f1a2ab", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/analyze_v2_scripts.py:248"}, "properties": {"repobilityId": "771d7efd0dedb3c1", "scanner": "scanner-primary", "fingerprint": "1e546bba79f1a2ab", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9c362725579a9123", "level": "none", "message": {"text": "Commented-code block (8 lines) in src/imagination_engine/config.py:34"}, "properties": {"repobilityId": "e62f375903f65130", "scanner": "scanner-primary", "fingerprint": "9c362725579a9123", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2786f039e2315ca1", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 src/imagination_engine/server.py:319"}, "properties": {"repobilityId": "ef5f4d28c43e6c71", "scanner": "scanner-primary", "fingerprint": "2786f039e2315ca1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-00c99054f3b5b7c3", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/imagination_engine/generator.py:606"}, "properties": {"repobilityId": "b611a3bdee3429e0", "scanner": "scanner-primary", "fingerprint": "00c99054f3b5b7c3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-18d698374e602519", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 src/imagination_engine/tts.py:68"}, "properties": {"repobilityId": "bcefe3f2d16961e2", "scanner": "scanner-primary", "fingerprint": "18d698374e602519", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "43d4c24b8c058d8b", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "04a859d5cd924ec3", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "fc20b40cd101ba7d", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "c38312521f6e2223", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "b66ded40a42ab465", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "be59dd2106465303", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "35bb964bbe7e7818", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "e2d950e8b78f571a", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-48bb869f7a04a532", "level": "error", "message": {"text": "FastAPI POST `generate` without auth dependency \u2014 src/imagination_engine/server.py:201"}, "properties": {"repobilityId": "6ad16eb53df8bc42", "scanner": "scanner-primary", "fingerprint": "48bb869f7a04a532", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/imagination_engine/server.py"}, "region": {"startLine": 201}}}]}, {"ruleId": "scanner-bb4bd6b786741e48", "level": "error", "message": {"text": "FastAPI POST `speak` without auth dependency \u2014 src/imagination_engine/server.py:212"}, "properties": {"repobilityId": "10e3cdb7af77ed62", "scanner": "scanner-primary", "fingerprint": "bb4bd6b786741e48", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/imagination_engine/server.py"}, "region": {"startLine": 212}}}]}, {"ruleId": "scanner-5036cb909414a6a1", "level": "error", "message": {"text": "FastAPI POST `record_save` without auth dependency \u2014 src/imagination_engine/server.py:267"}, "properties": {"repobilityId": "9b33554f519c60de", "scanner": "scanner-primary", "fingerprint": "5036cb909414a6a1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/imagination_engine/server.py"}, "region": {"startLine": 267}}}]}, {"ruleId": "scanner-edf8aa846211adc9", "level": "error", "message": {"text": "FastAPI DELETE `record_delete` without auth dependency \u2014 src/imagination_engine/server.py:286"}, "properties": {"repobilityId": "b8c766044ae267e7", "scanner": "scanner-primary", "fingerprint": "edf8aa846211adc9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/imagination_engine/server.py"}, "region": {"startLine": 286}}}]}, {"ruleId": "scanner-8474d0d08b3146e4", "level": "error", "message": {"text": "FastAPI POST `record_train` without auth dependency \u2014 src/imagination_engine/server.py:302"}, "properties": {"repobilityId": "420777f347471717", "scanner": "scanner-primary", "fingerprint": "8474d0d08b3146e4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/imagination_engine/server.py"}, "region": {"startLine": 302}}}]}, {"ruleId": "scanner-90d5db57aba30a9d", "level": "error", "message": {"text": "FastAPI POST `intake_start` without auth dependency \u2014 src/imagination_engine/server.py:348"}, "properties": {"repobilityId": "87e8af85077dbbf5", "scanner": "scanner-primary", "fingerprint": "90d5db57aba30a9d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/imagination_engine/server.py"}, "region": {"startLine": 348}}}]}, {"ruleId": "scanner-adfe94464792bdb7", "level": "error", "message": {"text": "FastAPI POST `intake_turn` without auth dependency \u2014 src/imagination_engine/server.py:356"}, "properties": {"repobilityId": "cef35b0684c4e51d", "scanner": "scanner-primary", "fingerprint": "adfe94464792bdb7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/imagination_engine/server.py"}, "region": {"startLine": 356}}}]}, {"ruleId": "scanner-53c926349e4064f5", "level": "error", "message": {"text": "FastAPI POST `intake_generate` without auth dependency \u2014 src/imagination_engine/server.py:399"}, "properties": {"repobilityId": "4e36f249d572f015", "scanner": "scanner-primary", "fingerprint": "53c926349e4064f5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/imagination_engine/server.py"}, "region": {"startLine": 399}}}]}, {"ruleId": "scanner-2df198eb592bf634", "level": "error", "message": {"text": "FastAPI POST `intake_reflect` without auth dependency \u2014 src/imagination_engine/server.py:521"}, "properties": {"repobilityId": "807ae9c6d39a07d2", "scanner": "scanner-primary", "fingerprint": "2df198eb592bf634", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/imagination_engine/server.py"}, "region": {"startLine": 521}}}]}, {"ruleId": "scanner-26196f07736b8f2f", "level": "error", "message": {"text": "FastAPI POST `companion_turn` without auth dependency \u2014 src/imagination_engine/server.py:560"}, "properties": {"repobilityId": "c13529b04be1f1f7", "scanner": "scanner-primary", "fingerprint": "26196f07736b8f2f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/imagination_engine/server.py"}, "region": {"startLine": 560}}}]}, {"ruleId": "scanner-59e1568bf3e251d2", "level": "error", "message": {"text": "FastAPI POST `ask_index` without auth dependency \u2014 src/imagination_engine/server.py:607"}, "properties": {"repobilityId": "c0a7723772086bba", "scanner": "scanner-primary", "fingerprint": "59e1568bf3e251d2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/imagination_engine/server.py"}, "region": {"startLine": 607}}}]}, {"ruleId": "scanner-dcffd08cf3f588f5", "level": "error", "message": {"text": "FastAPI POST `ask_query` without auth dependency \u2014 src/imagination_engine/server.py:617"}, "properties": {"repobilityId": "62d078f0d89e3969", "scanner": "scanner-primary", "fingerprint": "dcffd08cf3f588f5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/imagination_engine/server.py"}, "region": {"startLine": 617}}}]}, {"ruleId": "scanner-eb424268118a5229", "level": "error", "message": {"text": "FastAPI POST `utility_run` without auth dependency \u2014 src/imagination_engine/server.py:677"}, "properties": {"repobilityId": "cd067a84c3047efd", "scanner": "scanner-primary", "fingerprint": "eb424268118a5229", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/imagination_engine/server.py"}, "region": {"startLine": 677}}}]}, {"ruleId": "scanner-89a7e7ed6683acbf", "level": "error", "message": {"text": "FastAPI POST `build_create` without auth dependency \u2014 src/imagination_engine/server.py:735"}, "properties": {"repobilityId": "6ab68780d797b1f9", "scanner": "scanner-primary", "fingerprint": "89a7e7ed6683acbf", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/imagination_engine/server.py"}, "region": {"startLine": 735}}}]}, {"ruleId": "scanner-ed9a0f90c8a6bf92", "level": "error", "message": {"text": "FastAPI POST `build_ask` without auth dependency \u2014 src/imagination_engine/server.py:771"}, "properties": {"repobilityId": "e8557b06104af014", "scanner": "scanner-primary", "fingerprint": "ed9a0f90c8a6bf92", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/imagination_engine/server.py"}, "region": {"startLine": 771}}}]}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "350de241fbc27c9f", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-da49fd123cc95586", "level": "note", "message": {"text": "Unused endpoint: GET /welcome"}, "properties": {"repobilityId": "2794eb39d08afbf1", "scanner": "scanner-primary", "fingerprint": "da49fd123cc95586", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5ff952867cb69636", "level": "note", "message": {"text": "Unused endpoint: GET /welcome/state"}, "properties": {"repobilityId": "8cf8af67261ff4ff", "scanner": "scanner-primary", "fingerprint": "5ff952867cb69636", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-10933152477dd941", "level": "note", "message": {"text": "Unused endpoint: GET /voices/options"}, "properties": {"repobilityId": "606eeb275935a392", "scanner": "scanner-primary", "fingerprint": "10933152477dd941", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c1493c9515919a8f", "level": "note", "message": {"text": "Unused endpoint: GET /dev"}, "properties": {"repobilityId": "14926c878eb3d86d", "scanner": "scanner-primary", "fingerprint": "c1493c9515919a8f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-970eb92d6ec2bfaa", "level": "note", "message": {"text": "Unused endpoint: POST /generate"}, "properties": {"repobilityId": "740992d15e570019", "scanner": "scanner-primary", "fingerprint": "970eb92d6ec2bfaa", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cc05e2496e726a3a", "level": "note", "message": {"text": "Unused endpoint: POST /speak"}, "properties": {"repobilityId": "c4922c925aed025a", "scanner": "scanner-primary", "fingerprint": "cc05e2496e726a3a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-863cb2066f0ce32d", "level": "note", "message": {"text": "Unused endpoint: GET /record"}, "properties": {"repobilityId": "8def8503e78feb20", "scanner": "scanner-primary", "fingerprint": "863cb2066f0ce32d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-809052f1b7649a8f", "level": "note", "message": {"text": "Unused endpoint: GET /record/speakers"}, "properties": {"repobilityId": "18cbe8bf74da6581", "scanner": "scanner-primary", "fingerprint": "809052f1b7649a8f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b5a8c678c3b54377", "level": "note", "message": {"text": "Unused endpoint: GET /record/sentences"}, "properties": {"repobilityId": "136b6bdb0fa7cdf2", "scanner": "scanner-primary", "fingerprint": "b5a8c678c3b54377", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-84dc13876717ec1a", "level": "note", "message": {"text": "Unused endpoint: GET /record/progress/{speaker_id}"}, "properties": {"repobilityId": "b86ca065a311b547", "scanner": "scanner-primary", "fingerprint": "84dc13876717ec1a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7991985d62f88867", "level": "note", "message": {"text": "Unused endpoint: POST /record/save/{speaker_id}/{sentence_id}"}, "properties": {"repobilityId": "f97f2bdfca50e7bf", "scanner": "scanner-primary", "fingerprint": "7991985d62f88867", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9bdee1e209b20616", "level": "note", "message": {"text": "Unused endpoint: DELETE /record/save/{speaker_id}/{sentence_id}"}, "properties": {"repobilityId": "2e2c0cea9e25bc18", "scanner": "scanner-primary", "fingerprint": "9bdee1e209b20616", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-396df4280cbb86f6", "level": "note", "message": {"text": "Unused endpoint: POST /record/train/{speaker_id}"}, "properties": {"repobilityId": "bd79a35f369d0537", "scanner": "scanner-primary", "fingerprint": "396df4280cbb86f6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-601e77cadf2a79e6", "level": "note", "message": {"text": "Unused endpoint: GET /record/train/{speaker_id}/status"}, "properties": {"repobilityId": "20e3617332f0f9f1", "scanner": "scanner-primary", "fingerprint": "601e77cadf2a79e6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ddc8a6e0803ad038", "level": "note", "message": {"text": "Unused endpoint: GET /intake"}, "properties": {"repobilityId": "ac0c0e90e3a65d18", "scanner": "scanner-primary", "fingerprint": "ddc8a6e0803ad038", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-301f6cdf9f8351f0", "level": "note", "message": {"text": "Unused endpoint: POST /intake/start"}, "properties": {"repobilityId": "360623dcdb5bc134", "scanner": "scanner-primary", "fingerprint": "301f6cdf9f8351f0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-05e60da00500f638", "level": "note", "message": {"text": "Unused endpoint: POST /intake/turn"}, "properties": {"repobilityId": "a37580c1b2c32c95", "scanner": "scanner-primary", "fingerprint": "05e60da00500f638", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c941fdfa8576f80c", "level": "note", "message": {"text": "Unused endpoint: GET /intake/{session_id}"}, "properties": {"repobilityId": "8bf1acd16ee52f37", "scanner": "scanner-primary", "fingerprint": "c941fdfa8576f80c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-20ce5b552db7a683", "level": "note", "message": {"text": "Unused endpoint: POST /intake/{session_id}/generate"}, "properties": {"repobilityId": "1b532e2b3c16b206", "scanner": "scanner-primary", "fingerprint": "20ce5b552db7a683", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cc65de2ca645df45", "level": "note", "message": {"text": "Unused endpoint: GET /intake/{session_id}/download"}, "properties": {"repobilityId": "82208943c83c4395", "scanner": "scanner-primary", "fingerprint": "cc65de2ca645df45", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-98e98b52722f7f50", "level": "note", "message": {"text": "Unused endpoint: GET /intake/{session_id}/status"}, "properties": {"repobilityId": "5d85717754740759", "scanner": "scanner-primary", "fingerprint": "98e98b52722f7f50", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e1c7d63b0e9c5cbe", "level": "note", "message": {"text": "Unused endpoint: POST /intake/{session_id}/reflect"}, "properties": {"repobilityId": "9ae1a6f7849bb415", "scanner": "scanner-primary", "fingerprint": "e1c7d63b0e9c5cbe", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-41a6de33665e35ff", "level": "note", "message": {"text": "Unused endpoint: GET /companion"}, "properties": {"repobilityId": "4ce5a17f241dd70d", "scanner": "scanner-primary", "fingerprint": "41a6de33665e35ff", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cd293beb46e1a289", "level": "note", "message": {"text": "Unused endpoint: POST /companion/turn"}, "properties": {"repobilityId": "270c1d20f2194128", "scanner": "scanner-primary", "fingerprint": "cd293beb46e1a289", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-445f4be0725a091c", "level": "note", "message": {"text": "Unused endpoint: GET /ask"}, "properties": {"repobilityId": "77952755a6a69308", "scanner": "scanner-primary", "fingerprint": "445f4be0725a091c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9c2d35d2b45ffa0d", "level": "note", "message": {"text": "Unused endpoint: POST /ask/index"}, "properties": {"repobilityId": "f6463575cb8ec60d", "scanner": "scanner-primary", "fingerprint": "9c2d35d2b45ffa0d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c3cc0fc1c88aa6e2", "level": "note", "message": {"text": "Unused endpoint: POST /ask/query"}, "properties": {"repobilityId": "207fb963f49d39fc", "scanner": "scanner-primary", "fingerprint": "c3cc0fc1c88aa6e2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1d8200bc5dbee699", "level": "note", "message": {"text": "Unused endpoint: GET /utility"}, "properties": {"repobilityId": "ed7f4335b641bd35", "scanner": "scanner-primary", "fingerprint": "1d8200bc5dbee699", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a366624527fb74ae", "level": "note", "message": {"text": "Unused endpoint: GET /utility/tasks"}, "properties": {"repobilityId": "ea3784d627964082", "scanner": "scanner-primary", "fingerprint": "a366624527fb74ae", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6c119a3375da82f3", "level": "note", "message": {"text": "Unused endpoint: POST /utility/run"}, "properties": {"repobilityId": "e2788fec754fa075", "scanner": "scanner-primary", "fingerprint": "6c119a3375da82f3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-044fbb8540a664cf", "level": "note", "message": {"text": "Unused endpoint: GET /build"}, "properties": {"repobilityId": "aa3fb2be9d499056", "scanner": "scanner-primary", "fingerprint": "044fbb8540a664cf", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3410f76b749ca575", "level": "note", "message": {"text": "Unused endpoint: GET /build/list"}, "properties": {"repobilityId": "2e58ee343fff6520", "scanner": "scanner-primary", "fingerprint": "3410f76b749ca575", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a65a1e620507b245", "level": "note", "message": {"text": "Unused endpoint: POST /build/create"}, "properties": {"repobilityId": "7f78d26429ce9bbc", "scanner": "scanner-primary", "fingerprint": "a65a1e620507b245", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-04722a83bed40d69", "level": "note", "message": {"text": "Unused endpoint: POST /build/ask"}, "properties": {"repobilityId": "3517c19c4044c6b6", "scanner": "scanner-primary", "fingerprint": "04722a83bed40d69", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}