{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-b038fb7a39370a65", "name": "Possibly dead Python function: cluster_node", "shortDescription": {"text": "Possibly dead Python function: cluster_node"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d3d37c8b01f706ac", "name": "Possibly dead Python function: profile_node", "shortDescription": {"text": "Possibly dead Python function: profile_node"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-288735573b826df5", "name": "Possibly dead Python function: ingest_node", "shortDescription": {"text": "Possibly dead Python function: ingest_node"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-38092232e136b230", "name": "Possibly dead Python function: evaluate_node", "shortDescription": {"text": "Possibly dead Python function: evaluate_node"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-471ba38df782ede3", "name": "Possibly dead Python function: select_node", "shortDescription": {"text": "Possibly dead Python function: select_node"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-17f4a50dca06d69a", "name": "Possibly dead Python function: natural_log_message", "shortDescription": {"text": "Possibly dead Python function: natural_log_message"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-77aa36b7e12e369b", "name": "`truncate` class without `title=` for hover reveal \u2014 web/components/run-card.tsx:14", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 web/components/run-card.tsx:14"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4803d16e64f1725f", "name": "`truncate` class without `title=` for hover reveal \u2014 web/components/charts/heatmap.tsx:33", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 web/components/charts/heatmap.tsx:33"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4abc1f8b4001ff39", "name": "`truncate` class without `title=` for hover reveal \u2014 web/components/wizard/column-selector.tsx:68", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 web/components/wizard/column-selector.tsx:68"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a5823f1252b6cda1", "name": "Dockerfile runs as root: web/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: web/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b526af7fd67aa2de", "name": "Docker base image is tag-pinned but not digest-pinned: node:22-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "19 tests / 107 src (ratio 0.18)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f5e6e78e173b3108", "name": "`fetch()` without try/.catch or AbortSignal \u2014 web/lib/api.ts:33", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 web/lib/api.ts:33"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d975e8fa90301afe", "name": "Legacy-named symbol `methodology_v1` in src/llm/methodology.py:1", "shortDescription": {"text": "Legacy-named symbol `methodology_v1` in src/llm/methodology.py:1"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-319e66a630e14977", "name": "2 env vars used in code but missing from .env.example", "shortDescription": {"text": "2 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `ARCHETYPE_CORS_ORIGINS`, `ARCHETYPE_DATA_DIR`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-02525d39071dd2c7", "name": "Near-duplicate function bodies in 5 places", "shortDescription": {"text": "Near-duplicate function bodies in 5 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nsrc/llm/chat_agent.py:stream_agent, src/llm/chat_agent.py:run_agent, src/llm/chat_agent.py:stream_chat, src/llm/chat_agent.py:answer_chat\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-14a48eadbd7b1b1e", "name": "FastAPI DELETE `remove_run` without auth dependency \u2014 api/routers/runs.py:67", "shortDescription": {"text": "FastAPI DELETE `remove_run` without auth dependency \u2014 api/routers/runs.py:67"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-495d1f7838f5d3fb", "name": "FastAPI POST `create_group_profile` without auth dependency \u2014 api/routers/runs.py:78", "shortDescription": {"text": "FastAPI POST `create_group_profile` without auth dependency \u2014 api/routers/runs.py:78"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-de4ca276e86d4fb5", "name": "FastAPI DELETE `delete_group_profile` without auth dependency \u2014 api/routers/runs.py:105", "shortDescription": {"text": "FastAPI DELETE `delete_group_profile` without auth dependency \u2014 api/routers/runs.py:105"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f4c52de1eed2a51d", "name": "FastAPI PATCH `edit_archetype` without auth dependency \u2014 api/routers/runs.py:120", "shortDescription": {"text": "FastAPI PATCH `edit_archetype` without auth dependency \u2014 api/routers/runs.py:120"}, "fullDescription": {"text": "`@router.patch` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0721ba428c3464cb", "name": "FastAPI POST `chat` without auth dependency \u2014 api/routers/runs.py:174", "shortDescription": {"text": "FastAPI POST `chat` without auth dependency \u2014 api/routers/runs.py:174"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-05c9c30d83585702", "name": "FastAPI POST `chat_stream` without auth dependency \u2014 api/routers/runs.py:209", "shortDescription": {"text": "FastAPI POST `chat_stream` without auth dependency \u2014 api/routers/runs.py:209"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7096a2b023addd2b", "name": "FastAPI POST `upload` without auth dependency \u2014 api/routers/datasets.py:77", "shortDescription": {"text": "FastAPI POST `upload` without auth dependency \u2014 api/routers/datasets.py:77"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3391c8e0fc71a89a", "name": "FastAPI POST `load_sample` without auth dependency \u2014 api/routers/datasets.py:84", "shortDescription": {"text": "FastAPI POST `load_sample` without auth dependency \u2014 api/routers/datasets.py:84"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b555c35b491c412a", "name": "FastAPI POST `suggest` without auth dependency \u2014 api/routers/datasets.py:106", "shortDescription": {"text": "FastAPI POST `suggest` without auth dependency \u2014 api/routers/datasets.py:106"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d7841ab7d84e9ee6", "name": "FastAPI POST `chat` without auth dependency \u2014 api/routers/datasets.py:119", "shortDescription": {"text": "FastAPI POST `chat` without auth dependency \u2014 api/routers/datasets.py:119"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f34d7bc5269e6c07", "name": "FastAPI POST `chat_stream` without auth dependency \u2014 api/routers/datasets.py:128", "shortDescription": {"text": "FastAPI POST `chat_stream` without auth dependency \u2014 api/routers/datasets.py:128"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8913bf31adaa6452", "name": "FastAPI POST `analyze` without auth dependency \u2014 api/routers/analyze.py:58", "shortDescription": {"text": "FastAPI POST `analyze` without auth dependency \u2014 api/routers/analyze.py:58"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4756b4c4da7d2088", "name": "Unused endpoint: GET /api/health", "shortDescription": {"text": "Unused endpoint: GET /api/health"}, "fullDescription": {"text": "`api/main.py` declares `GET /api/health` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`api/main.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bad01ac2222e29f1", "name": "Unused endpoint: GET /{run_id}", "shortDescription": {"text": "Unused endpoint: GET /{run_id}"}, "fullDescription": {"text": "`api/routers/runs.py` declares `GET /{run_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-87f033efdf5491d6", "name": "Unused endpoint: DELETE /{run_id}", "shortDescription": {"text": "Unused endpoint: DELETE /{run_id}"}, "fullDescription": {"text": "`api/routers/runs.py` declares `DELETE /{run_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6a911181ab248019", "name": "Unused endpoint: POST /{run_id}/profile-group", "shortDescription": {"text": "Unused endpoint: POST /{run_id}/profile-group"}, "fullDescription": {"text": "`api/routers/runs.py` declares `POST /{run_id}/profile-group` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fce40cf1c3ca540d", "name": "Unused endpoint: DELETE /{run_id}/profiles/{profile_id}", "shortDescription": {"text": "Unused endpoint: DELETE /{run_id}/profiles/{profile_id}"}, "fullDescription": {"text": "`api/routers/runs.py` declares `DELETE /{run_id}/profiles/{profile_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0aaa7c343cceb385", "name": "Unused endpoint: PATCH /{run_id}/archetypes/{cluster_id}", "shortDescription": {"text": "Unused endpoint: PATCH /{run_id}/archetypes/{cluster_id}"}, "fullDescription": {"text": "`api/routers/runs.py` declares `PATCH /{run_id}/archetypes/{cluster_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c54874a3cd8f07c5", "name": "Unused endpoint: POST /{run_id}/chat", "shortDescription": {"text": "Unused endpoint: POST /{run_id}/chat"}, "fullDescription": {"text": "`api/routers/runs.py` declares `POST /{run_id}/chat` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8f2baaa4ac64e0e9", "name": "Unused endpoint: POST /{run_id}/chat/stream", "shortDescription": {"text": "Unused endpoint: POST /{run_id}/chat/stream"}, "fullDescription": {"text": "`api/routers/runs.py` declares `POST /{run_id}/chat/stream` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d2a1b9f398bb97f3", "name": "Unused endpoint: GET /{run_id}/export/archetypes.csv", "shortDescription": {"text": "Unused endpoint: GET /{run_id}/export/archetypes.csv"}, "fullDescription": {"text": "`api/routers/runs.py` declares `GET /{run_id}/export/archetypes.csv` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ca4897fa92d806e", "name": "Unused endpoint: GET /{run_id}/export/labeled.csv", "shortDescription": {"text": "Unused endpoint: GET /{run_id}/export/labeled.csv"}, "fullDescription": {"text": "`api/routers/runs.py` declares `GET /{run_id}/export/labeled.csv` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a5221bf41e2cc8bf", "name": "Unused endpoint: GET /{run_id}/export/report.md", "shortDescription": {"text": "Unused endpoint: GET /{run_id}/export/report.md"}, "fullDescription": {"text": "`api/routers/runs.py` declares `GET /{run_id}/export/report.md` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6236b283b79811b8", "name": "Unused endpoint: POST /upload", "shortDescription": {"text": "Unused endpoint: POST /upload"}, "fullDescription": {"text": "`api/routers/datasets.py` declares `POST /upload` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fca3f0b64c781eed", "name": "Unused endpoint: POST /sample", "shortDescription": {"text": "Unused endpoint: POST /sample"}, "fullDescription": {"text": "`api/routers/datasets.py` declares `POST /sample` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d7a741e2bbe14973", "name": "Unused endpoint: GET /{dataset_id}", "shortDescription": {"text": "Unused endpoint: GET /{dataset_id}"}, "fullDescription": {"text": "`api/routers/datasets.py` declares `GET /{dataset_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f649590a37355343", "name": "Unused endpoint: POST /{dataset_id}/suggest-columns", "shortDescription": {"text": "Unused endpoint: POST /{dataset_id}/suggest-columns"}, "fullDescription": {"text": "`api/routers/datasets.py` declares `POST /{dataset_id}/suggest-columns` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-74f14ae4e48f3f39", "name": "Unused endpoint: POST /{dataset_id}/chat", "shortDescription": {"text": "Unused endpoint: POST /{dataset_id}/chat"}, "fullDescription": {"text": "`api/routers/datasets.py` declares `POST /{dataset_id}/chat` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a08b23ca0075acad", "name": "Unused endpoint: POST /{dataset_id}/chat/stream", "shortDescription": {"text": "Unused endpoint: POST /{dataset_id}/chat/stream"}, "fullDescription": {"text": "`api/routers/datasets.py` declares `POST /{dataset_id}/chat/stream` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-51624d0205414dea", "name": "Unused endpoint: POST /{dataset_id}/analyze", "shortDescription": {"text": "Unused endpoint: POST /{dataset_id}/analyze"}, "fullDescription": {"text": "`api/routers/analyze.py` declares `POST /{dataset_id}/analyze` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/18351"}, "properties": {"repository": "Rodato/archetypeSuite", "repoUrl": "https://github.com/Rodato/archetypeSuite", "branch": "main"}, "results": [{"ruleId": "scanner-b038fb7a39370a65", "level": "note", "message": {"text": "Possibly dead Python function: cluster_node"}, "properties": {"repobilityId": "4008d237600892aa", "scanner": "scanner-primary", "fingerprint": "b038fb7a39370a65", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agents/nodes/cluster_node.py:12"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d3d37c8b01f706ac", "level": "note", "message": {"text": "Possibly dead Python function: profile_node"}, "properties": {"repobilityId": "686acc81cc359426", "scanner": "scanner-primary", "fingerprint": "d3d37c8b01f706ac", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agents/nodes/profile_node.py:7"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-288735573b826df5", "level": "note", "message": {"text": "Possibly dead Python function: ingest_node"}, "properties": {"repobilityId": "3c5aeea6848e7a84", "scanner": "scanner-primary", "fingerprint": "288735573b826df5", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agents/nodes/ingest_node.py:7"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-38092232e136b230", "level": "note", "message": {"text": "Possibly dead Python function: evaluate_node"}, "properties": {"repobilityId": "188094e56e9e0c0d", "scanner": "scanner-primary", "fingerprint": "38092232e136b230", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agents/nodes/evaluate_node.py:8"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-471ba38df782ede3", "level": "note", "message": {"text": "Possibly dead Python function: select_node"}, "properties": {"repobilityId": "b58da0bacd2083e5", "scanner": "scanner-primary", "fingerprint": "471ba38df782ede3", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/agents/nodes/select_node.py:5"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-17f4a50dca06d69a", "level": "note", "message": {"text": "Possibly dead Python function: natural_log_message"}, "properties": {"repobilityId": "54fcd887ede95d16", "scanner": "scanner-primary", "fingerprint": "17f4a50dca06d69a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/core/quality.py:87"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-77aa36b7e12e369b", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 web/components/run-card.tsx:14"}, "properties": {"repobilityId": "991955147b0d0798", "scanner": "scanner-primary", "fingerprint": "77aa36b7e12e369b", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-4803d16e64f1725f", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 web/components/charts/heatmap.tsx:33"}, "properties": {"repobilityId": "a6e7ecb8e08a4f8b", "scanner": "scanner-primary", "fingerprint": "4803d16e64f1725f", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-4abc1f8b4001ff39", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 web/components/wizard/column-selector.tsx:68"}, "properties": {"repobilityId": "a7cee4cffe284d77", "scanner": "scanner-primary", "fingerprint": "4abc1f8b4001ff39", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-a5823f1252b6cda1", "level": "warning", "message": {"text": "Dockerfile runs as root: web/Dockerfile"}, "properties": {"repobilityId": "ee2f067d8416357d", "scanner": "scanner-primary", "fingerprint": "a5823f1252b6cda1", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-b526af7fd67aa2de", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-slim"}, "properties": {"repobilityId": "8066692302c009d8", "scanner": "scanner-primary", "fingerprint": "b526af7fd67aa2de", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/Dockerfile"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "a6184c4cdb5486b1", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "b287d45228a7b6ea", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "43b2fbc311b582c4", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "96229e1cb3ac25b1", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "878c2509707179a4", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-f5e6e78e173b3108", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 web/lib/api.ts:33"}, "properties": {"repobilityId": "9735fe26bac913d6", "scanner": "scanner-primary", "fingerprint": "f5e6e78e173b3108", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-d975e8fa90301afe", "level": "note", "message": {"text": "Legacy-named symbol `methodology_v1` in src/llm/methodology.py:1"}, "properties": {"repobilityId": "57e20525e167d1cc", "scanner": "scanner-primary", "fingerprint": "d975e8fa90301afe", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-319e66a630e14977", "level": "none", "message": {"text": "2 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "d838d1fc5d8231c9", "scanner": "scanner-primary", "fingerprint": "319e66a630e14977", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-02525d39071dd2c7", "level": "note", "message": {"text": "Near-duplicate function bodies in 5 places"}, "properties": {"repobilityId": "9a7199ab42243d2c", "scanner": "scanner-primary", "fingerprint": "02525d39071dd2c7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-14a48eadbd7b1b1e", "level": "error", "message": {"text": "FastAPI DELETE `remove_run` without auth dependency \u2014 api/routers/runs.py:67"}, "properties": {"repobilityId": "b76c89eb3bc495f0", "scanner": "scanner-primary", "fingerprint": "14a48eadbd7b1b1e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/routers/runs.py"}, "region": {"startLine": 67}}}]}, {"ruleId": "scanner-495d1f7838f5d3fb", "level": "error", "message": {"text": "FastAPI POST `create_group_profile` without auth dependency \u2014 api/routers/runs.py:78"}, "properties": {"repobilityId": "7e2635e36f5962e4", "scanner": "scanner-primary", "fingerprint": "495d1f7838f5d3fb", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/routers/runs.py"}, "region": {"startLine": 78}}}]}, {"ruleId": "scanner-de4ca276e86d4fb5", "level": "error", "message": {"text": "FastAPI DELETE `delete_group_profile` without auth dependency \u2014 api/routers/runs.py:105"}, "properties": {"repobilityId": "186139799d9dd197", "scanner": "scanner-primary", "fingerprint": "de4ca276e86d4fb5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/routers/runs.py"}, "region": {"startLine": 105}}}]}, {"ruleId": "scanner-f4c52de1eed2a51d", "level": "error", "message": {"text": "FastAPI PATCH `edit_archetype` without auth dependency \u2014 api/routers/runs.py:120"}, "properties": {"repobilityId": "5e8483484f19d4a1", "scanner": "scanner-primary", "fingerprint": "f4c52de1eed2a51d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/routers/runs.py"}, "region": {"startLine": 120}}}]}, {"ruleId": "scanner-0721ba428c3464cb", "level": "error", "message": {"text": "FastAPI POST `chat` without auth dependency \u2014 api/routers/runs.py:174"}, "properties": {"repobilityId": "ec6a3848f9007218", "scanner": "scanner-primary", "fingerprint": "0721ba428c3464cb", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/routers/runs.py"}, "region": {"startLine": 174}}}]}, {"ruleId": "scanner-05c9c30d83585702", "level": "error", "message": {"text": "FastAPI POST `chat_stream` without auth dependency \u2014 api/routers/runs.py:209"}, "properties": {"repobilityId": "801ddac56bbb194f", "scanner": "scanner-primary", "fingerprint": "05c9c30d83585702", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/routers/runs.py"}, "region": {"startLine": 209}}}]}, {"ruleId": "scanner-7096a2b023addd2b", "level": "error", "message": {"text": "FastAPI POST `upload` without auth dependency \u2014 api/routers/datasets.py:77"}, "properties": {"repobilityId": "3978ba046c940485", "scanner": "scanner-primary", "fingerprint": "7096a2b023addd2b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/routers/datasets.py"}, "region": {"startLine": 77}}}]}, {"ruleId": "scanner-3391c8e0fc71a89a", "level": "error", "message": {"text": "FastAPI POST `load_sample` without auth dependency \u2014 api/routers/datasets.py:84"}, "properties": {"repobilityId": "f5d62e20d9448ffd", "scanner": "scanner-primary", "fingerprint": "3391c8e0fc71a89a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/routers/datasets.py"}, "region": {"startLine": 84}}}]}, {"ruleId": "scanner-b555c35b491c412a", "level": "error", "message": {"text": "FastAPI POST `suggest` without auth dependency \u2014 api/routers/datasets.py:106"}, "properties": {"repobilityId": "7466b51882c9a7dd", "scanner": "scanner-primary", "fingerprint": "b555c35b491c412a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/routers/datasets.py"}, "region": {"startLine": 106}}}]}, {"ruleId": "scanner-d7841ab7d84e9ee6", "level": "error", "message": {"text": "FastAPI POST `chat` without auth dependency \u2014 api/routers/datasets.py:119"}, "properties": {"repobilityId": "523cc9500fd56778", "scanner": "scanner-primary", "fingerprint": "d7841ab7d84e9ee6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/routers/datasets.py"}, "region": {"startLine": 119}}}]}, {"ruleId": "scanner-f34d7bc5269e6c07", "level": "error", "message": {"text": "FastAPI POST `chat_stream` without auth dependency \u2014 api/routers/datasets.py:128"}, "properties": {"repobilityId": "df6a2c8204801914", "scanner": "scanner-primary", "fingerprint": "f34d7bc5269e6c07", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/routers/datasets.py"}, "region": {"startLine": 128}}}]}, {"ruleId": "scanner-8913bf31adaa6452", "level": "error", "message": {"text": "FastAPI POST `analyze` without auth dependency \u2014 api/routers/analyze.py:58"}, "properties": {"repobilityId": "f33e2f59624ccb8f", "scanner": "scanner-primary", "fingerprint": "8913bf31adaa6452", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/routers/analyze.py"}, "region": {"startLine": 58}}}]}, {"ruleId": "scanner-4756b4c4da7d2088", "level": "note", "message": {"text": "Unused endpoint: GET /api/health"}, "properties": {"repobilityId": "0d164cc624e7b19a", "scanner": "scanner-primary", "fingerprint": "4756b4c4da7d2088", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "010a849383b56d00", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bad01ac2222e29f1", "level": "note", "message": {"text": "Unused endpoint: GET /{run_id}"}, "properties": {"repobilityId": "a6697cce16424843", "scanner": "scanner-primary", "fingerprint": "bad01ac2222e29f1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-87f033efdf5491d6", "level": "note", "message": {"text": "Unused endpoint: DELETE /{run_id}"}, "properties": {"repobilityId": "4bbb08173059df2c", "scanner": "scanner-primary", "fingerprint": "87f033efdf5491d6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6a911181ab248019", "level": "note", "message": {"text": "Unused endpoint: POST /{run_id}/profile-group"}, "properties": {"repobilityId": "8a223bc4e7c31aab", "scanner": "scanner-primary", "fingerprint": "6a911181ab248019", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fce40cf1c3ca540d", "level": "note", "message": {"text": "Unused endpoint: DELETE /{run_id}/profiles/{profile_id}"}, "properties": {"repobilityId": "ecf91c019f1c8aec", "scanner": "scanner-primary", "fingerprint": "fce40cf1c3ca540d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0aaa7c343cceb385", "level": "note", "message": {"text": "Unused endpoint: PATCH /{run_id}/archetypes/{cluster_id}"}, "properties": {"repobilityId": "1af8909147983ec0", "scanner": "scanner-primary", "fingerprint": "0aaa7c343cceb385", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c54874a3cd8f07c5", "level": "note", "message": {"text": "Unused endpoint: POST /{run_id}/chat"}, "properties": {"repobilityId": "4eb2349a270725bc", "scanner": "scanner-primary", "fingerprint": "c54874a3cd8f07c5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8f2baaa4ac64e0e9", "level": "note", "message": {"text": "Unused endpoint: POST /{run_id}/chat/stream"}, "properties": {"repobilityId": "e566cc715a8f93d4", "scanner": "scanner-primary", "fingerprint": "8f2baaa4ac64e0e9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d2a1b9f398bb97f3", "level": "note", "message": {"text": "Unused endpoint: GET /{run_id}/export/archetypes.csv"}, "properties": {"repobilityId": "c844b95372c8d775", "scanner": "scanner-primary", "fingerprint": "d2a1b9f398bb97f3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3ca4897fa92d806e", "level": "note", "message": {"text": "Unused endpoint: GET /{run_id}/export/labeled.csv"}, "properties": {"repobilityId": "6ebad03525f43703", "scanner": "scanner-primary", "fingerprint": "3ca4897fa92d806e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a5221bf41e2cc8bf", "level": "note", "message": {"text": "Unused endpoint: GET /{run_id}/export/report.md"}, "properties": {"repobilityId": "efc7c7379cff2494", "scanner": "scanner-primary", "fingerprint": "a5221bf41e2cc8bf", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6236b283b79811b8", "level": "note", "message": {"text": "Unused endpoint: POST /upload"}, "properties": {"repobilityId": "737aa92e8263b0a6", "scanner": "scanner-primary", "fingerprint": "6236b283b79811b8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fca3f0b64c781eed", "level": "note", "message": {"text": "Unused endpoint: POST /sample"}, "properties": {"repobilityId": "ab244ddf7ae45808", "scanner": "scanner-primary", "fingerprint": "fca3f0b64c781eed", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d7a741e2bbe14973", "level": "note", "message": {"text": "Unused endpoint: GET /{dataset_id}"}, "properties": {"repobilityId": "e35163b7d2ffd5b1", "scanner": "scanner-primary", "fingerprint": "d7a741e2bbe14973", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f649590a37355343", "level": "note", "message": {"text": "Unused endpoint: POST /{dataset_id}/suggest-columns"}, "properties": {"repobilityId": "459d4e72656e4f66", "scanner": "scanner-primary", "fingerprint": "f649590a37355343", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-74f14ae4e48f3f39", "level": "note", "message": {"text": "Unused endpoint: POST /{dataset_id}/chat"}, "properties": {"repobilityId": "c7bd5bdde3561e8f", "scanner": "scanner-primary", "fingerprint": "74f14ae4e48f3f39", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a08b23ca0075acad", "level": "note", "message": {"text": "Unused endpoint: POST /{dataset_id}/chat/stream"}, "properties": {"repobilityId": "17ee1c5fa36e12ce", "scanner": "scanner-primary", "fingerprint": "a08b23ca0075acad", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-51624d0205414dea", "level": "note", "message": {"text": "Unused endpoint: POST /{dataset_id}/analyze"}, "properties": {"repobilityId": "cc0fb87da1311414", "scanner": "scanner-primary", "fingerprint": "51624d0205414dea", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}