{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-1cd5422ac5257516", "name": "Possibly dead Python function: fake_run_agent", "shortDescription": {"text": "Possibly dead Python function: fake_run_agent"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-123d56b5d1cee046", "name": "Possibly dead Python function: fake_run_agent", "shortDescription": {"text": "Possibly dead Python function: fake_run_agent"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c0ee359a7bb2ed9f", "name": "Possibly dead Python function: fake_run_agent_loop", "shortDescription": {"text": "Possibly dead Python function: fake_run_agent_loop"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-08d07cd71d8267a8", "name": "Possibly dead Python function: fake_stream", "shortDescription": {"text": "Possibly dead Python function: fake_stream"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2abb3d857d326217", "name": "Possibly dead Python function: fake_run_agent", "shortDescription": {"text": "Possibly dead Python function: fake_run_agent"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ab8009f858b128ea", "name": "Possibly dead Python function: mark_pending", "shortDescription": {"text": "Possibly dead Python function: mark_pending"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c2fb73c320a23074", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/components/DashboardHome.tsx:131", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/components/DashboardHome.tsx:131"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-420cbb72f616c9a1", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/app/team/AgentDetailPanel.tsx:49", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/app/team/AgentDetailPanel.tsx:49"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9c63dac8c9d76914", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/app/team/page.tsx:55", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/app/team/page.tsx:55"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-98ed184f77c27928", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/app/team/[slug]/AgentDetailView.tsx:125", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/app/team/[slug]/AgentDetailView.tsx:125"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-828a06c4538fd738", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/app/traces/page.tsx:94", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/app/traces/page.tsx:94"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7434098f89a8013c", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/app/memory/page.tsx:51", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/app/memory/page.tsx:51"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ae3cc9ffae73a7e9", "name": "`truncate` class without `title=` for hover reveal \u2014 frontend/app/costs/page.tsx:313", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/app/costs/page.tsx:313"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ac5472c106cc4bc0", "name": "`truncate` class without `title=` for hover reveal \u2014 docs-site/components/SearchDialog.tsx:168", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 docs-site/components/SearchDialog.tsx:168"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1749a9800b4eecd9", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 docs-site/app/layout.tsx:78", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 docs-site/app/layout.tsx:78"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d56754e7876590ef", "name": "Insecure pattern 'dangerous_innerhtml' in docs-site/app/layout.tsx:78", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in docs-site/app/layout.tsx:78"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-40f51d0afdc2c502", "name": "Insecure pattern 'cors_wildcard' in src/horus_os/server/api.py:487", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in src/horus_os/server/api.py:487"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ced2ef40f40a35e9", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/horus_os/server/static/index.html:297", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/horus_os/server/static/index.html:297"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e3b0cb52b73b45d2", "name": "Very large file: scripts/release_gate.py (1379 lines)", "shortDescription": {"text": "Very large file: scripts/release_gate.py (1379 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ad4e64e0edef310b", "name": "Very large file: src/horus_os/storage.py (1286 lines)", "shortDescription": {"text": "Very large file: src/horus_os/storage.py (1286 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ff02ab4c33562ddc", "name": "Very large file: src/horus_os/server/api.py (1453 lines)", "shortDescription": {"text": "Very large file: src/horus_os/server/api.py (1453 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 161 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 80 placeholder/mock markers across 28 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9d79c4077342a7d0", "name": "Runtime service client appears to use placeholder configuration", "shortDescription": {"text": "Runtime service client appears to use placeholder configuration"}, "fullDescription": {"text": "A runtime source file appears to wire Supabase/Firebase/AI/payment-style clients to placeholder URLs, keys, or fallback values. In the Fable corpus this often means the UI/API shape is present while the backend service is not actually configured."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cae5dfaed50febd0", "name": "Commented-code block (7 lines) in frontend/components/TourOverlay.tsx:9", "shortDescription": {"text": "Commented-code block (7 lines) in frontend/components/TourOverlay.tsx:9"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d98cfae42cf9b202", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/lib/api.ts:355", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/lib/api.ts:355"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-07b21bc7ca12eea6", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/lib/__tests__/api-base.test.ts:7", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/lib/__tests__/api-base.test.ts:7"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0fde131e8e200c84", "name": "Commented-code block (5 lines) in tests/test_adapters_otel_install_smoke.py:73", "shortDescription": {"text": "Commented-code block (5 lines) in tests/test_adapters_otel_install_smoke.py:73"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-70cd1666b54dcc33", "name": "Legacy-named symbol `bundle_legacy` in tests/test_release_verification.py:95", "shortDescription": {"text": "Legacy-named symbol `bundle_legacy` in tests/test_release_verification.py:95"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0bf408871438c93f", "name": "Commented-code block (5 lines) in tests/test_decision_no_pypi.py:32", "shortDescription": {"text": "Commented-code block (5 lines) in tests/test_decision_no_pypi.py:32"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-75fe1a617d619746", "name": "Commented-code block (6 lines) in tests/test_adapters_discord_bot.py:305", "shortDescription": {"text": "Commented-code block (6 lines) in tests/test_adapters_discord_bot.py:305"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e45dc0ce3fc95a18", "name": "Legacy-named symbol `test_agents_tab_pitfall_11_hover_copy` in tests/test_dashboard_agents_extension.py:37", "shortDescription": {"text": "Legacy-named symbol `test_agents_tab_pitfall_11_hover_copy` in tests/test_dashboard_agents_extension.py:37"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1e1b7ea0d670993d", "name": "Commented-code block (6 lines) in tests/test_release_md_stop_before_tag.py:38", "shortDescription": {"text": "Commented-code block (6 lines) in tests/test_release_md_stop_before_tag.py:38"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-86cf4d50a5d01740", "name": "Legacy-named symbol `test_banner_render_function_and_override_copy` in tests/test_dashboard_pricing_banner.py:47", "shortDescription": {"text": "Legacy-named symbol `test_banner_render_function_and_override_copy` in tests/test_dashboard_pricing_banner.py:47"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-011e366062e5c329", "name": "Legacy-named symbol `test_init_db_schema_is_v2` in tests/test_cli_init.py:46", "shortDescription": {"text": "Legacy-named symbol `test_init_db_schema_is_v2` in tests/test_cli_init.py:46"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d5549916c40a763e", "name": "Commented-code block (6 lines) in tests/test_cli_usage.py:365", "shortDescription": {"text": "Commented-code block (6 lines) in tests/test_cli_usage.py:365"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-997a255190f70a5b", "name": "Commented-code block (7 lines) in tests/test_release_gate.py:71", "shortDescription": {"text": "Commented-code block (7 lines) in tests/test_release_gate.py:71"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-901124e5e55f26b8", "name": "Commented-code block (5 lines) in tests/mcp/test_mcp_trust_gate.py:125", "shortDescription": {"text": "Commented-code block (5 lines) in tests/mcp/test_mcp_trust_gate.py:125"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0227650ae728ec71", "name": "Commented-code block (8 lines) in tests/observability/test_cost_annotator.py:113", "shortDescription": {"text": "Commented-code block (8 lines) in tests/observability/test_cost_annotator.py:113"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b5cb5abc2eff6858", "name": "Commented-code block (7 lines) in tests/test_contribution_gate_pitfalls/test_ci_hardening_workflow_structure.py:44", "shortDescription": {"text": "Commented-code block (7 lines) in tests/test_contribution_gate_pitfalls/test_ci_hardening_workflow_structure.py:44"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-01c07b066c8e7049", "name": "Commented-code block (5 lines) in tests/plugins/test_reference_plugin_install_local.py:69", "shortDescription": {"text": "Commented-code block (5 lines) in tests/plugins/test_reference_plugin_install_local.py:69"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fa13e85c4d0dbe5a", "name": "Legacy-named symbol `hash_old` in tests/plugins/test_installer_upgrade_diff.py:164", "shortDescription": {"text": "Legacy-named symbol `hash_old` in tests/plugins/test_installer_upgrade_diff.py:164"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9f3fd523663262d2", "name": "Commented-code block (5 lines) in scripts/verify_release.py:71", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/verify_release.py:71"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8f8f6b35433f52f8", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/verify_release.py:185", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/verify_release.py:185"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f23b501ad01ff348", "name": "Commented-code block (5 lines) in scripts/install_smoke.py:58", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/install_smoke.py:58"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-643966f0acabc501", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/install_smoke.py:198", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/install_smoke.py:198"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b0ebb7779633bda1", "name": "Commented-code block (5 lines) in scripts/release_gate.py:1246", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/release_gate.py:1246"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-af7f44010e6f6cdc", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/release_gate.py:297", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/release_gate.py:297"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1f7a51c6a2cd243e", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/build_dashboard.py:45", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/build_dashboard.py:45"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6140235f178553e9", "name": "Commented-code block (5 lines) in examples/horus-os-example-plugin/src/horus_os_example_plugin/adapter.py:29", "shortDescription": {"text": "Commented-code block (5 lines) in examples/horus-os-example-plugin/src/horus_os_example_plugin/adapter.py:29"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bca48fdbf9db4f39", "name": "Commented-code block (5 lines) in src/horus_os/storage.py:387", "shortDescription": {"text": "Commented-code block (5 lines) in src/horus_os/storage.py:387"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f1758608477f9142", "name": "Commented-code block (5 lines) in src/horus_os/config.py:42", "shortDescription": {"text": "Commented-code block (5 lines) in src/horus_os/config.py:42"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b39c92f94b75602c", "name": "Commented-code block (5 lines) in src/horus_os/agent.py:33", "shortDescription": {"text": "Commented-code block (5 lines) in src/horus_os/agent.py:33"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6fddd4c52f9cf9cd", "name": "Commented-code block (9 lines) in src/horus_os/__main__.py:519", "shortDescription": {"text": "Commented-code block (9 lines) in src/horus_os/__main__.py:519"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-be70f33d6cbb8af2", "name": "Legacy-named symbol `_start_legacy` in src/horus_os/adapters/discord_adapter.py:186", "shortDescription": {"text": "Legacy-named symbol `_start_legacy` in src/horus_os/adapters/discord_adapter.py:186"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fce165886be98e10", "name": "Commented-code block (6 lines) in src/horus_os/adapters/base.py:221", "shortDescription": {"text": "Commented-code block (6 lines) in src/horus_os/adapters/base.py:221"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-33a4668d31a9b582", "name": "Commented-code block (5 lines) in src/horus_os/adapters/otel_adapter.py:82", "shortDescription": {"text": "Commented-code block (5 lines) in src/horus_os/adapters/otel_adapter.py:82"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-70287fb2f35f4019", "name": "Commented-code block (5 lines) in src/horus_os/cli/init_cmd.py:51", "shortDescription": {"text": "Commented-code block (5 lines) in src/horus_os/cli/init_cmd.py:51"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4e318e1a710013f2", "name": "Commented-code block (7 lines) in src/horus_os/cli/serve_cmd.py:16", "shortDescription": {"text": "Commented-code block (7 lines) in src/horus_os/cli/serve_cmd.py:16"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-97e9c1343c03e838", "name": "Commented-code block (5 lines) in src/horus_os/cli/run_cmd.py:90", "shortDescription": {"text": "Commented-code block (5 lines) in src/horus_os/cli/run_cmd.py:90"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-be47c8f6e4979149", "name": "Commented-code block (5 lines) in src/horus_os/cli/usage_cmd.py:50", "shortDescription": {"text": "Commented-code block (5 lines) in src/horus_os/cli/usage_cmd.py:50"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-10a27112100efc37", "name": "Commented-code block (5 lines) in src/horus_os/observability/cost.py:55", "shortDescription": {"text": "Commented-code block (5 lines) in src/horus_os/observability/cost.py:55"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-67061707cfcc221c", "name": "Commented-code block (5 lines) in src/horus_os/memory/notes.py:30", "shortDescription": {"text": "Commented-code block (5 lines) in src/horus_os/memory/notes.py:30"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4c6cd080b5edb386", "name": "Network/subprocess call without timeout or try/except \u2014 src/horus_os/service/manager.py:61", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 src/horus_os/service/manager.py:61"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a0fdaacc142425d9", "name": "Commented-code block (5 lines) in src/horus_os/server/api.py:29", "shortDescription": {"text": "Commented-code block (5 lines) in src/horus_os/server/api.py:29"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f30b43b53b096234", "name": "Commented-code block (5 lines) in src/horus_os/tools/_ssrf.py:27", "shortDescription": {"text": "Commented-code block (5 lines) in src/horus_os/tools/_ssrf.py:27"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c8a9247cbe7a2e45", "name": "Commented-code block (5 lines) in src/horus_os/tools/shell.py:46", "shortDescription": {"text": "Commented-code block (5 lines) in src/horus_os/tools/shell.py:46"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2fc62f98ee65ca7a", "name": "Commented-code block (5 lines) in src/horus_os/seed/__init__.py:35", "shortDescription": {"text": "Commented-code block (5 lines) in src/horus_os/seed/__init__.py:35"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-123bde923f828035", "name": "Commented-code block (5 lines) in src/horus_os/plugins/capability_catalog.py:90", "shortDescription": {"text": "Commented-code block (5 lines) in src/horus_os/plugins/capability_catalog.py:90"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d488fac351be22b1", "name": "Commented-code block (5 lines) in src/horus_os/plugins/api.py:172", "shortDescription": {"text": "Commented-code block (5 lines) in src/horus_os/plugins/api.py:172"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-722b476e46bf042a", "name": "Commented-code block (7 lines) in src/horus_os/plugins/installer.py:92", "shortDescription": {"text": "Commented-code block (7 lines) in src/horus_os/plugins/installer.py:92"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-414bcdcaa3bca111", "name": "Network/subprocess call without timeout or try/except \u2014 src/horus_os/plugins/installer.py:169", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 src/horus_os/plugins/installer.py:169"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nscripts/verify_release.py:check_wheel_signature, scripts/verify_release.py:check_sdist_signature\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nsrc/horus_os/cli/traces_cmd.py:run_traces, src/horus_os/cli/agents_cmd.py:run_agents, src/horus_os/cli/schedule_cmd.py:run_schedule\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-02525d39071dd2c7", "name": "Near-duplicate function bodies in 5 places", "shortDescription": {"text": "Near-duplicate function bodies in 5 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nsrc/horus_os/memory/tools.py:handler, src/horus_os/memory/tools.py:handler, src/horus_os/memory/tools.py:handler, src/horus_os/memory/tools.py:handler\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49c98f7cedd9c977", "name": "Near-duplicate function bodies in 4 places", "shortDescription": {"text": "Near-duplicate function bodies in 4 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nsrc/horus_os/_providers/_anthropic.py:call_anthropic, src/horus_os/_providers/_anthropic.py:call_anthropic_async, src/horus_os/_providers/_openai_compat.py:call_openai_compat, src/horus_os/_providers/_openai_compat.py:call_openai_compat_async\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-53ea02c46c95a0d5", "name": "FastAPI POST `_handle_events` without auth dependency \u2014 src/horus_os/adapters/slack_adapter.py:128", "shortDescription": {"text": "FastAPI POST `_handle_events` without auth dependency \u2014 src/horus_os/adapters/slack_adapter.py:128"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ef0f01310b73c35b", "name": "FastAPI POST `_handle_commands` without auth dependency \u2014 src/horus_os/adapters/slack_adapter.py:156", "shortDescription": {"text": "FastAPI POST `_handle_commands` without auth dependency \u2014 src/horus_os/adapters/slack_adapter.py:156"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8007d5a41c142e82", "name": "FastAPI POST `_handle_webhook` without auth dependency \u2014 src/horus_os/adapters/webhook.py:65", "shortDescription": {"text": "FastAPI POST `_handle_webhook` without auth dependency \u2014 src/horus_os/adapters/webhook.py:65"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7481d74ebcfa19c0", "name": "FastAPI POST `_voice_complete` without auth dependency \u2014 src/horus_os/adapters/voice_adapter.py:288", "shortDescription": {"text": "FastAPI POST `_voice_complete` without auth dependency \u2014 src/horus_os/adapters/voice_adapter.py:288"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-48ed397775d97214", "name": "FastAPI POST `start_research` without auth dependency \u2014 src/horus_os/research/api.py:217", "shortDescription": {"text": "FastAPI POST `start_research` without auth dependency \u2014 src/horus_os/research/api.py:217"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c2c66de400c7676b", "name": "FastAPI POST `confirm_research` without auth dependency \u2014 src/horus_os/research/api.py:286", "shortDescription": {"text": "FastAPI POST `confirm_research` without auth dependency \u2014 src/horus_os/research/api.py:286"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-80b2685f20f8d32e", "name": "FastAPI POST `cancel_research` without auth dependency \u2014 src/horus_os/research/api.py:384", "shortDescription": {"text": "FastAPI POST `cancel_research` without auth dependency \u2014 src/horus_os/research/api.py:384"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f3be59618d6eec31", "name": "FastAPI POST `enable_plugin` without auth dependency \u2014 src/horus_os/server/plugins_api.py:200", "shortDescription": {"text": "FastAPI POST `enable_plugin` without auth dependency \u2014 src/horus_os/server/plugins_api.py:200"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6659c568b0bfe29c", "name": "FastAPI POST `disable_plugin` without auth dependency \u2014 src/horus_os/server/plugins_api.py:210", "shortDescription": {"text": "FastAPI POST `disable_plugin` without auth dependency \u2014 src/horus_os/server/plugins_api.py:210"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fb508fe473794252", "name": "FastAPI POST `grant_capability` without auth dependency \u2014 src/horus_os/server/plugins_api.py:220", "shortDescription": {"text": "FastAPI POST `grant_capability` without auth dependency \u2014 src/horus_os/server/plugins_api.py:220"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5841c1c3a762972a", "name": "FastAPI DELETE `revoke_capability` without auth dependency \u2014 src/horus_os/server/plugins_api.py:264", "shortDescription": {"text": "FastAPI DELETE `revoke_capability` without auth dependency \u2014 src/horus_os/server/plugins_api.py:264"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f825b2c7c5a5f31b", "name": "FastAPI DELETE `delete_task` without auth dependency \u2014 src/horus_os/server/dashboard_api.py:327", "shortDescription": {"text": "FastAPI DELETE `delete_task` without auth dependency \u2014 src/horus_os/server/dashboard_api.py:327"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2b274874b4d8d8c3", "name": "FastAPI DELETE `delete_trace` without auth dependency \u2014 src/horus_os/server/dashboard_api.py:342", "shortDescription": {"text": "FastAPI DELETE `delete_trace` without auth dependency \u2014 src/horus_os/server/dashboard_api.py:342"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f4bb82009e7a33cb", "name": "FastAPI POST `post_integration_key` without auth dependency \u2014 src/horus_os/server/integrations_write.py:253", "shortDescription": {"text": "FastAPI POST `post_integration_key` without auth dependency \u2014 src/horus_os/server/integrations_write.py:253"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d28f30807bc0f8de", "name": "FastAPI POST `post_integration_verify` without auth dependency \u2014 src/horus_os/server/integrations_write.py:292", "shortDescription": {"text": "FastAPI POST `post_integration_verify` without auth dependency \u2014 src/horus_os/server/integrations_write.py:292"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-997e8131208e239f", "name": "FastAPI POST `agents_create` without auth dependency \u2014 src/horus_os/server/api.py:600", "shortDescription": {"text": "FastAPI POST `agents_create` without auth dependency \u2014 src/horus_os/server/api.py:600"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a1cc7dde001cb0de", "name": "FastAPI PATCH `agents_edit` without auth dependency \u2014 src/horus_os/server/api.py:635", "shortDescription": {"text": "FastAPI PATCH `agents_edit` without auth dependency \u2014 src/horus_os/server/api.py:635"}, "fullDescription": {"text": "`@router.patch` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5bd1f0dd0816cfd8", "name": "FastAPI DELETE `agents_delete` without auth dependency \u2014 src/horus_os/server/api.py:665", "shortDescription": {"text": "FastAPI DELETE `agents_delete` without auth dependency \u2014 src/horus_os/server/api.py:665"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9caea6131d8fe311", "name": "FastAPI POST `store_install` without auth dependency \u2014 src/horus_os/server/api.py:724", "shortDescription": {"text": "FastAPI POST `store_install` without auth dependency \u2014 src/horus_os/server/api.py:724"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9f67fe0862c9f83a", "name": "FastAPI POST `upload` without auth dependency \u2014 src/horus_os/server/api.py:845", "shortDescription": {"text": "FastAPI POST `upload` without auth dependency \u2014 src/horus_os/server/api.py:845"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-16fe3898d75ff828", "name": "FastAPI POST `chat` without auth dependency \u2014 src/horus_os/server/api.py:902", "shortDescription": {"text": "FastAPI POST `chat` without auth dependency \u2014 src/horus_os/server/api.py:902"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fd9017ad88d29d1e", "name": "FastAPI POST `chat_stream` without auth dependency \u2014 src/horus_os/server/api.py:987", "shortDescription": {"text": "FastAPI POST `chat_stream` without auth dependency \u2014 src/horus_os/server/api.py:987"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6d28b527cb0302c6", "name": "FastAPI POST `disable_adapter` without auth dependency \u2014 src/horus_os/server/api.py:1167", "shortDescription": {"text": "FastAPI POST `disable_adapter` without auth dependency \u2014 src/horus_os/server/api.py:1167"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-178229448daf8af5", "name": "FastAPI POST `enable_adapter` without auth dependency \u2014 src/horus_os/server/api.py:1197", "shortDescription": {"text": "FastAPI POST `enable_adapter` without auth dependency \u2014 src/horus_os/server/api.py:1197"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b102cdb893c921b8", "name": "Dangling fetch: GET /search-index.json (docs-site/components/SearchDialog.tsx:52)", "shortDescription": {"text": "Dangling fetch: GET /search-index.json (docs-site/components/SearchDialog.tsx:52)"}, "fullDescription": {"text": "`docs-site/components/SearchDialog.tsx:52` calls `GET /search-index.json` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/search-index.json`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2d154b5561196c10", "name": "Unused endpoint: POST /api/adapters/slack/events", "shortDescription": {"text": "Unused endpoint: POST /api/adapters/slack/events"}, "fullDescription": {"text": "`src/horus_os/adapters/slack_adapter.py` declares `POST /api/adapters/slack/events` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-feaa3149f632d131", "name": "Unused endpoint: POST /api/adapters/slack/commands", "shortDescription": {"text": "Unused endpoint: POST /api/adapters/slack/commands"}, "fullDescription": {"text": "`src/horus_os/adapters/slack_adapter.py` declares `POST /api/adapters/slack/commands` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b4ebe9a345c3e710", "name": "Unused endpoint: POST /api/adapters/webhook", "shortDescription": {"text": "Unused endpoint: POST /api/adapters/webhook"}, "fullDescription": {"text": "`src/horus_os/adapters/webhook.py` declares `POST /api/adapters/webhook` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-44dae8f65542bc11", "name": "Unused endpoint: GET /api/adapters/voice/status", "shortDescription": {"text": "Unused endpoint: GET /api/adapters/voice/status"}, "fullDescription": {"text": "`src/horus_os/adapters/voice_adapter.py` declares `GET /api/adapters/voice/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b677ff24cc45497a", "name": "Unused endpoint: GET /api/adapters/voice/twiml", "shortDescription": {"text": "Unused endpoint: GET /api/adapters/voice/twiml"}, "fullDescription": {"text": "`src/horus_os/adapters/voice_adapter.py` declares `GET /api/adapters/voice/twiml` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-515645c1290e3e46", "name": "Unused endpoint: POST /api/adapters/voice/calls/{record_id}/complete", "shortDescription": {"text": "Unused endpoint: POST /api/adapters/voice/calls/{record_id}/complete"}, "fullDescription": {"text": "`src/horus_os/adapters/voice_adapter.py` declares `POST /api/adapters/voice/calls/{record_id}/complete` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a7cecc0d897343ea", "name": "Unused endpoint: POST /api/research", "shortDescription": {"text": "Unused endpoint: POST /api/research"}, "fullDescription": {"text": "`src/horus_os/research/api.py` declares `POST /api/research` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e61134ba1e6875ef", "name": "Unused endpoint: POST /api/research/{task_id}/start", "shortDescription": {"text": "Unused endpoint: POST /api/research/{task_id}/start"}, "fullDescription": {"text": "`src/horus_os/research/api.py` declares `POST /api/research/{task_id}/start` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-89dfdf3d67531283", "name": "Unused endpoint: GET /api/research/{task_id}/progress", "shortDescription": {"text": "Unused endpoint: GET /api/research/{task_id}/progress"}, "fullDescription": {"text": "`src/horus_os/research/api.py` declares `GET /api/research/{task_id}/progress` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b7fdfe30d8ba14eb", "name": "Unused endpoint: GET /api/research/{task_id}/report", "shortDescription": {"text": "Unused endpoint: GET /api/research/{task_id}/report"}, "fullDescription": {"text": "`src/horus_os/research/api.py` declares `GET /api/research/{task_id}/report` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0fbd5defc965c2ea", "name": "Unused endpoint: POST /api/research/{task_id}/cancel", "shortDescription": {"text": "Unused endpoint: POST /api/research/{task_id}/cancel"}, "fullDescription": {"text": "`src/horus_os/research/api.py` declares `POST /api/research/{task_id}/cancel` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3e91f42808613291", "name": "Unused endpoint: GET /api/plugins", "shortDescription": {"text": "Unused endpoint: GET /api/plugins"}, "fullDescription": {"text": "`src/horus_os/server/plugins_api.py` declares `GET /api/plugins` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-599000fe1a69bcea", "name": "Unused endpoint: GET /api/plugins/{name}", "shortDescription": {"text": "Unused endpoint: GET /api/plugins/{name}"}, "fullDescription": {"text": "`src/horus_os/server/plugins_api.py` declares `GET /api/plugins/{name}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cf0d63af15a4bd28", "name": "Unused endpoint: POST /api/plugins/{name}/enable", "shortDescription": {"text": "Unused endpoint: POST /api/plugins/{name}/enable"}, "fullDescription": {"text": "`src/horus_os/server/plugins_api.py` declares `POST /api/plugins/{name}/enable` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1d41f28c374e92a0", "name": "Unused endpoint: POST /api/plugins/{name}/disable", "shortDescription": {"text": "Unused endpoint: POST /api/plugins/{name}/disable"}, "fullDescription": {"text": "`src/horus_os/server/plugins_api.py` declares `POST /api/plugins/{name}/disable` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd256bed4abab0a6", "name": "Unused endpoint: POST /api/plugins/{name}/grant", "shortDescription": {"text": "Unused endpoint: POST /api/plugins/{name}/grant"}, "fullDescription": {"text": "`src/horus_os/server/plugins_api.py` declares `POST /api/plugins/{name}/grant` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a8edaf0e2153310d", "name": "Unused endpoint: DELETE /api/plugins/{name}/grant/{capability}", "shortDescription": {"text": "Unused endpoint: DELETE /api/plugins/{name}/grant/{capability}"}, "fullDescription": {"text": "`src/horus_os/server/plugins_api.py` declares `DELETE /api/plugins/{name}/grant/{capability}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5c519e593dfeb4e5", "name": "Unused endpoint: GET /api/observability/plugins", "shortDescription": {"text": "Unused endpoint: GET /api/observability/plugins"}, "fullDescription": {"text": "`src/horus_os/server/plugins_api.py` declares `GET /api/observability/plugins` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2b1d988396924177", "name": "Unused endpoint: GET /api/team", "shortDescription": {"text": "Unused endpoint: GET /api/team"}, "fullDescription": {"text": "`src/horus_os/server/dashboard_api.py` declares `GET /api/team` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8bc50c380a5b1078", "name": "Unused endpoint: GET /api/team/{name}", "shortDescription": {"text": "Unused endpoint: GET /api/team/{name}"}, "fullDescription": {"text": "`src/horus_os/server/dashboard_api.py` declares `GET /api/team/{name}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a74464b0f1216462", "name": "Unused endpoint: GET /api/memory", "shortDescription": {"text": "Unused endpoint: GET /api/memory"}, "fullDescription": {"text": "`src/horus_os/server/dashboard_api.py` declares `GET /api/memory` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7c96d3488e0d6843", "name": "Unused endpoint: GET /api/memory/note", "shortDescription": {"text": "Unused endpoint: GET /api/memory/note"}, "fullDescription": {"text": "`src/horus_os/server/dashboard_api.py` declares `GET /api/memory/note` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d30aa36f85b5752f", "name": "Unused endpoint: GET /api/activity", "shortDescription": {"text": "Unused endpoint: GET /api/activity"}, "fullDescription": {"text": "`src/horus_os/server/dashboard_api.py` declares `GET /api/activity` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cf16ae0930dc161a", "name": "Unused endpoint: GET /api/tasks", "shortDescription": {"text": "Unused endpoint: GET /api/tasks"}, "fullDescription": {"text": "`src/horus_os/server/dashboard_api.py` declares `GET /api/tasks` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cd3fec950f0a5169", "name": "Unused endpoint: DELETE /api/tasks/{task_id}", "shortDescription": {"text": "Unused endpoint: DELETE /api/tasks/{task_id}"}, "fullDescription": {"text": "`src/horus_os/server/dashboard_api.py` declares `DELETE /api/tasks/{task_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6c3159428d56e3fe", "name": "Unused endpoint: DELETE /api/traces/{trace_id}", "shortDescription": {"text": "Unused endpoint: DELETE /api/traces/{trace_id}"}, "fullDescription": {"text": "`src/horus_os/server/dashboard_api.py` declares `DELETE /api/traces/{trace_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4756b4c4da7d2088", "name": "Unused endpoint: GET /api/health", "shortDescription": {"text": "Unused endpoint: GET /api/health"}, "fullDescription": {"text": "`src/horus_os/server/dashboard_api.py` declares `GET /api/health` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-379b09f9de636500", "name": "Unused endpoint: GET /api/settings", "shortDescription": {"text": "Unused endpoint: GET /api/settings"}, "fullDescription": {"text": "`src/horus_os/server/dashboard_api.py` declares `GET /api/settings` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cae6664615b08cb4", "name": "Unused endpoint: GET /api/integrations", "shortDescription": {"text": "Unused endpoint: GET /api/integrations"}, "fullDescription": {"text": "`src/horus_os/server/dashboard_api.py` declares `GET /api/integrations` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-619909e7c6fb2b85", "name": "Unused endpoint: GET /api/integrations/vercel/status", "shortDescription": {"text": "Unused endpoint: GET /api/integrations/vercel/status"}, "fullDescription": {"text": "`src/horus_os/server/dashboard_api.py` declares `GET /api/integrations/vercel/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-58e5c613f20a8bbe", "name": "Unused endpoint: POST /api/integrations/{name}/keys", "shortDescription": {"text": "Unused endpoint: POST /api/integrations/{name}/keys"}, "fullDescription": {"text": "`src/horus_os/server/integrations_write.py` declares `POST /api/integrations/{name}/keys` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f9a34f28ae8a9776", "name": "Unused endpoint: POST /api/integrations/{name}/verify", "shortDescription": {"text": "Unused endpoint: POST /api/integrations/{name}/verify"}, "fullDescription": {"text": "`src/horus_os/server/integrations_write.py` declares `POST /api/integrations/{name}/verify` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bebe76d0d0622914", "name": "Unused endpoint: GET /api/traces", "shortDescription": {"text": "Unused endpoint: GET /api/traces"}, "fullDescription": {"text": "`src/horus_os/server/api.py` declares `GET /api/traces` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b536835028fd6b62", "name": "Unused endpoint: GET /api/traces/{trace_id}", "shortDescription": {"text": "Unused endpoint: GET /api/traces/{trace_id}"}, "fullDescription": {"text": "`src/horus_os/server/api.py` declares `GET /api/traces/{trace_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5eeb82d749239127", "name": "Unused endpoint: GET /api/traces/{trace_id}/children", "shortDescription": {"text": "Unused endpoint: GET /api/traces/{trace_id}/children"}, "fullDescription": {"text": "`src/horus_os/server/api.py` declares `GET /api/traces/{trace_id}/children` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c4b0361ac0f5eeb9", "name": "Unused endpoint: GET /api/agents", "shortDescription": {"text": "Unused endpoint: GET /api/agents"}, "fullDescription": {"text": "`src/horus_os/server/api.py` declares `GET /api/agents` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d01a3a14b321e7d9", "name": "Unused endpoint: GET /api/agents/{name}", "shortDescription": {"text": "Unused endpoint: GET /api/agents/{name}"}, "fullDescription": {"text": "`src/horus_os/server/api.py` declares `GET /api/agents/{name}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ab31d7e480a710b2", "name": "Unused endpoint: POST /api/agents", "shortDescription": {"text": "Unused endpoint: POST /api/agents"}, "fullDescription": {"text": "`src/horus_os/server/api.py` declares `POST /api/agents` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-62dedfc156b76f3b", "name": "Unused endpoint: PATCH /api/agents/{name}", "shortDescription": {"text": "Unused endpoint: PATCH /api/agents/{name}"}, "fullDescription": {"text": "`src/horus_os/server/api.py` declares `PATCH /api/agents/{name}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f1d3968c92f01e06", "name": "Unused endpoint: DELETE /api/agents/{name}", "shortDescription": {"text": "Unused endpoint: DELETE /api/agents/{name}"}, "fullDescription": {"text": "`src/horus_os/server/api.py` declares `DELETE /api/agents/{name}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e5f452a234411d7d", "name": "Unused endpoint: GET /api/agents/{name}/export", "shortDescription": {"text": "Unused endpoint: GET /api/agents/{name}/export"}, "fullDescription": {"text": "`src/horus_os/server/api.py` declares `GET /api/agents/{name}/export` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-35307ee713707cfa", "name": "Unused endpoint: GET /api/store", "shortDescription": {"text": "Unused endpoint: GET /api/store"}, "fullDescription": {"text": "`src/horus_os/server/api.py` declares `GET /api/store` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-01d0b3fecce7bd16", "name": "Unused endpoint: GET /api/store/{slug}", "shortDescription": {"text": "Unused endpoint: GET /api/store/{slug}"}, "fullDescription": {"text": "`src/horus_os/server/api.py` declares `GET /api/store/{slug}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-93967f67ab3a108b", "name": "Unused endpoint: POST /api/store/{slug}/install", "shortDescription": {"text": "Unused endpoint: POST /api/store/{slug}/install"}, "fullDescription": {"text": "`src/horus_os/server/api.py` declares `POST /api/store/{slug}/install` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a871b15183a0df55", "name": "Unused endpoint: GET /api/writes", "shortDescription": {"text": "Unused endpoint: GET /api/writes"}, "fullDescription": {"text": "`src/horus_os/server/api.py` declares `GET /api/writes` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2faf9c471c2e38ea", "name": "Unused endpoint: GET /api/observability/cost", "shortDescription": {"text": "Unused endpoint: GET /api/observability/cost"}, "fullDescription": {"text": "`src/horus_os/server/api.py` declares `GET /api/observability/cost` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b6b71072a8f10674", "name": "Unused endpoint: GET /api/observability/cost-by-model", "shortDescription": {"text": "Unused endpoint: GET /api/observability/cost-by-model"}, "fullDescription": {"text": "`src/horus_os/server/api.py` declares `GET /api/observability/cost-by-model` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e527d6966ffe5345", "name": "Unused endpoint: GET /api/observability/latency", "shortDescription": {"text": "Unused endpoint: GET /api/observability/latency"}, "fullDescription": {"text": "`src/horus_os/server/api.py` declares `GET /api/observability/latency` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1a543f1d3234982e", "name": "Unused endpoint: GET /api/observability/tools", "shortDescription": {"text": "Unused endpoint: GET /api/observability/tools"}, "fullDescription": {"text": "`src/horus_os/server/api.py` declares `GET /api/observability/tools` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d0d720187ed71ba9", "name": "Unused endpoint: GET /api/observability/llm-calls", "shortDescription": {"text": "Unused endpoint: GET /api/observability/llm-calls"}, "fullDescription": {"text": "`src/horus_os/server/api.py` declares `GET /api/observability/llm-calls` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/18160"}, "properties": {"repository": "Ridou/horus-os", "repoUrl": "https://github.com/Ridou/horus-os", "branch": "main"}, "results": [{"ruleId": "scanner-1cd5422ac5257516", "level": "note", "message": {"text": "Possibly dead Python function: fake_run_agent"}, "properties": {"repobilityId": "81560c77eb23627e", "scanner": "scanner-primary", "fingerprint": "1cd5422ac5257516", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/discord_adapter.py:106"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-123d56b5d1cee046", "level": "note", "message": {"text": "Possibly dead Python function: fake_run_agent"}, "properties": {"repobilityId": "81560c77eb23627e", "scanner": "scanner-primary", "fingerprint": "123d56b5d1cee046", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/slack_adapter.py:92"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c0ee359a7bb2ed9f", "level": "note", "message": {"text": "Possibly dead Python function: fake_run_agent_loop"}, "properties": {"repobilityId": "4636a12d1a37f6e9", "scanner": "scanner-primary", "fingerprint": "c0ee359a7bb2ed9f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/multi_agent.py:50"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-08d07cd71d8267a8", "level": "note", "message": {"text": "Possibly dead Python function: fake_stream"}, "properties": {"repobilityId": "10545bb2d80c6a42", "scanner": "scanner-primary", "fingerprint": "08d07cd71d8267a8", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/streaming.py:39"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2abb3d857d326217", "level": "note", "message": {"text": "Possibly dead Python function: fake_run_agent"}, "properties": {"repobilityId": "81560c77eb23627e", "scanner": "scanner-primary", "fingerprint": "2abb3d857d326217", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/email_adapter.py:128"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ab8009f858b128ea", "level": "note", "message": {"text": "Possibly dead Python function: mark_pending"}, "properties": {"repobilityId": "8b51574305d6b705", "scanner": "scanner-primary", "fingerprint": "ab8009f858b128ea", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/horus_os/plugins/registry.py:360"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c2fb73c320a23074", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/components/DashboardHome.tsx:131"}, "properties": {"repobilityId": "cfb31c1ef8f05365", "scanner": "scanner-primary", "fingerprint": "c2fb73c320a23074", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-420cbb72f616c9a1", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/app/team/AgentDetailPanel.tsx:49"}, "properties": {"repobilityId": "fb51b296ecbe64b2", "scanner": "scanner-primary", "fingerprint": "420cbb72f616c9a1", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-9c63dac8c9d76914", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/app/team/page.tsx:55"}, "properties": {"repobilityId": "dd6ab9a832da4418", "scanner": "scanner-primary", "fingerprint": "9c63dac8c9d76914", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-98ed184f77c27928", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/app/team/[slug]/AgentDetailView.tsx:125"}, "properties": {"repobilityId": "ceea5e9fef1b09ac", "scanner": "scanner-primary", "fingerprint": "98ed184f77c27928", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-828a06c4538fd738", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/app/traces/page.tsx:94"}, "properties": {"repobilityId": "97bcafe45778d8ab", "scanner": "scanner-primary", "fingerprint": "828a06c4538fd738", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-7434098f89a8013c", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/app/memory/page.tsx:51"}, "properties": {"repobilityId": "90907b2718c2e88b", "scanner": "scanner-primary", "fingerprint": "7434098f89a8013c", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-ae3cc9ffae73a7e9", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 frontend/app/costs/page.tsx:313"}, "properties": {"repobilityId": "4ecbc02fbe2fdba7", "scanner": "scanner-primary", "fingerprint": "ae3cc9ffae73a7e9", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-ac5472c106cc4bc0", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 docs-site/components/SearchDialog.tsx:168"}, "properties": {"repobilityId": "5b2cc14e6e7fd033", "scanner": "scanner-primary", "fingerprint": "ac5472c106cc4bc0", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-1749a9800b4eecd9", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 docs-site/app/layout.tsx:78"}, "properties": {"repobilityId": "db2396f173fd74fc", "scanner": "scanner-primary", "fingerprint": "1749a9800b4eecd9", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-d56754e7876590ef", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in docs-site/app/layout.tsx:78"}, "properties": {"repobilityId": "6520f40e233c5a38", "scanner": "scanner-primary", "fingerprint": "d56754e7876590ef", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs-site/app/layout.tsx"}, "region": {"startLine": 78}}}]}, {"ruleId": "scanner-40f51d0afdc2c502", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in src/horus_os/server/api.py:487"}, "properties": {"repobilityId": "0ab03e656554c5da", "scanner": "scanner-primary", "fingerprint": "40f51d0afdc2c502", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/horus_os/server/api.py"}, "region": {"startLine": 487}}}]}, {"ruleId": "scanner-ced2ef40f40a35e9", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/horus_os/server/static/index.html:297"}, "properties": {"repobilityId": "7748a47ff13973cd", "scanner": "scanner-primary", "fingerprint": "ced2ef40f40a35e9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/horus_os/server/static/index.html"}, "region": {"startLine": 297}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e3b0cb52b73b45d2", "level": "note", "message": {"text": "Very large file: scripts/release_gate.py (1379 lines)"}, "properties": {"repobilityId": "cc83fe421f875004", "scanner": "scanner-primary", "fingerprint": "e3b0cb52b73b45d2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ad4e64e0edef310b", "level": "note", "message": {"text": "Very large file: src/horus_os/storage.py (1286 lines)"}, "properties": {"repobilityId": "53f9ac0710dea788", "scanner": "scanner-primary", "fingerprint": "ad4e64e0edef310b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ff02ab4c33562ddc", "level": "note", "message": {"text": "Very large file: src/horus_os/server/api.py (1453 lines)"}, "properties": {"repobilityId": "61aaed62e438f706", "scanner": "scanner-primary", "fingerprint": "ff02ab4c33562ddc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "b6497c8952bd305f", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "b7d22a59256d9baf", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-9d79c4077342a7d0", "level": "warning", "message": {"text": "Runtime service client appears to use placeholder configuration"}, "properties": {"repobilityId": "9c7592afd2814ee8", "scanner": "scanner-primary", "fingerprint": "9d79c4077342a7d0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "runtime-config", "service-client", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "daa6eb8401dc67ca", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "f09f5673075aacf5", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "a57559b0e3550cc4", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-cae5dfaed50febd0", "level": "none", "message": {"text": "Commented-code block (7 lines) in frontend/components/TourOverlay.tsx:9"}, "properties": {"repobilityId": "684c5d4ad6b75ba2", "scanner": "scanner-primary", "fingerprint": "cae5dfaed50febd0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d98cfae42cf9b202", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/lib/api.ts:355"}, "properties": {"repobilityId": "c8aed09525ecbca2", "scanner": "scanner-primary", "fingerprint": "d98cfae42cf9b202", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-07b21bc7ca12eea6", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/lib/__tests__/api-base.test.ts:7"}, "properties": {"repobilityId": "1ecb4507ff1d5819", "scanner": "scanner-primary", "fingerprint": "07b21bc7ca12eea6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-0fde131e8e200c84", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/test_adapters_otel_install_smoke.py:73"}, "properties": {"repobilityId": "2e337d7c92333620", "scanner": "scanner-primary", "fingerprint": "0fde131e8e200c84", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-70cd1666b54dcc33", "level": "note", "message": {"text": "Legacy-named symbol `bundle_legacy` in tests/test_release_verification.py:95"}, "properties": {"repobilityId": "13c95129e85dc1fd", "scanner": "scanner-primary", "fingerprint": "70cd1666b54dcc33", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-0bf408871438c93f", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/test_decision_no_pypi.py:32"}, "properties": {"repobilityId": "25eec73e9bd66e6c", "scanner": "scanner-primary", "fingerprint": "0bf408871438c93f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-75fe1a617d619746", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/test_adapters_discord_bot.py:305"}, "properties": {"repobilityId": "d8ee713b128378cc", "scanner": "scanner-primary", "fingerprint": "75fe1a617d619746", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e45dc0ce3fc95a18", "level": "note", "message": {"text": "Legacy-named symbol `test_agents_tab_pitfall_11_hover_copy` in tests/test_dashboard_agents_extension.py:37"}, "properties": {"repobilityId": "8dbdd0b502824a89", "scanner": "scanner-primary", "fingerprint": "e45dc0ce3fc95a18", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-1e1b7ea0d670993d", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/test_release_md_stop_before_tag.py:38"}, "properties": {"repobilityId": "8a5d73f5f896dd53", "scanner": "scanner-primary", "fingerprint": "1e1b7ea0d670993d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-86cf4d50a5d01740", "level": "note", "message": {"text": "Legacy-named symbol `test_banner_render_function_and_override_copy` in tests/test_dashboard_pricing_banner.py:47"}, "properties": {"repobilityId": "6205ad07f7c25f87", "scanner": "scanner-primary", "fingerprint": "86cf4d50a5d01740", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-011e366062e5c329", "level": "note", "message": {"text": "Legacy-named symbol `test_init_db_schema_is_v2` in tests/test_cli_init.py:46"}, "properties": {"repobilityId": "c34026955a8dde5a", "scanner": "scanner-primary", "fingerprint": "011e366062e5c329", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-d5549916c40a763e", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/test_cli_usage.py:365"}, "properties": {"repobilityId": "9ba6249800fd2e7c", "scanner": "scanner-primary", "fingerprint": "d5549916c40a763e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-997a255190f70a5b", "level": "none", "message": {"text": "Commented-code block (7 lines) in tests/test_release_gate.py:71"}, "properties": {"repobilityId": "ac4ae119b4800cfb", "scanner": "scanner-primary", "fingerprint": "997a255190f70a5b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-901124e5e55f26b8", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/mcp/test_mcp_trust_gate.py:125"}, "properties": {"repobilityId": "e2a1f7e09953b1ce", "scanner": "scanner-primary", "fingerprint": "901124e5e55f26b8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0227650ae728ec71", "level": "none", "message": {"text": "Commented-code block (8 lines) in tests/observability/test_cost_annotator.py:113"}, "properties": {"repobilityId": "a833ca96407950a4", "scanner": "scanner-primary", "fingerprint": "0227650ae728ec71", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b5cb5abc2eff6858", "level": "none", "message": {"text": "Commented-code block (7 lines) in tests/test_contribution_gate_pitfalls/test_ci_hardening_workflow_structure.py:44"}, "properties": {"repobilityId": "26c37cd360bdb43b", "scanner": "scanner-primary", "fingerprint": "b5cb5abc2eff6858", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-01c07b066c8e7049", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/plugins/test_reference_plugin_install_local.py:69"}, "properties": {"repobilityId": "30232dbf6ce9486f", "scanner": "scanner-primary", "fingerprint": "01c07b066c8e7049", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fa13e85c4d0dbe5a", "level": "note", "message": {"text": "Legacy-named symbol `hash_old` in tests/plugins/test_installer_upgrade_diff.py:164"}, "properties": {"repobilityId": "c8d153c0aa7c0544", "scanner": "scanner-primary", "fingerprint": "fa13e85c4d0dbe5a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-9f3fd523663262d2", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/verify_release.py:71"}, "properties": {"repobilityId": "9d2bc8be4a471123", "scanner": "scanner-primary", "fingerprint": "9f3fd523663262d2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8f8f6b35433f52f8", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/verify_release.py:185"}, "properties": {"repobilityId": "0fa8d463dad02df8", "scanner": "scanner-primary", "fingerprint": "8f8f6b35433f52f8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-f23b501ad01ff348", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/install_smoke.py:58"}, "properties": {"repobilityId": "933d93aeeb141bc9", "scanner": "scanner-primary", "fingerprint": "f23b501ad01ff348", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-643966f0acabc501", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/install_smoke.py:198"}, "properties": {"repobilityId": "08cc6fef68ad8105", "scanner": "scanner-primary", "fingerprint": "643966f0acabc501", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b0ebb7779633bda1", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/release_gate.py:1246"}, "properties": {"repobilityId": "67f13e896537558e", "scanner": "scanner-primary", "fingerprint": "b0ebb7779633bda1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-af7f44010e6f6cdc", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/release_gate.py:297"}, "properties": {"repobilityId": "359e406a98a210bd", "scanner": "scanner-primary", "fingerprint": "af7f44010e6f6cdc", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-1f7a51c6a2cd243e", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/build_dashboard.py:45"}, "properties": {"repobilityId": "addcf88c90d38448", "scanner": "scanner-primary", "fingerprint": "1f7a51c6a2cd243e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-6140235f178553e9", "level": "none", "message": {"text": "Commented-code block (5 lines) in examples/horus-os-example-plugin/src/horus_os_example_plugin/adapter.py:29"}, "properties": {"repobilityId": "c7ced3e1c034bd7d", "scanner": "scanner-primary", "fingerprint": "6140235f178553e9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bca48fdbf9db4f39", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/horus_os/storage.py:387"}, "properties": {"repobilityId": "59d59bf6b22481ab", "scanner": "scanner-primary", "fingerprint": "bca48fdbf9db4f39", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f1758608477f9142", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/horus_os/config.py:42"}, "properties": {"repobilityId": "297a3bad726b3023", "scanner": "scanner-primary", "fingerprint": "f1758608477f9142", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b39c92f94b75602c", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/horus_os/agent.py:33"}, "properties": {"repobilityId": "3048c081c994a297", "scanner": "scanner-primary", "fingerprint": "b39c92f94b75602c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6fddd4c52f9cf9cd", "level": "none", "message": {"text": "Commented-code block (9 lines) in src/horus_os/__main__.py:519"}, "properties": {"repobilityId": "5a3c3c32ea7298e4", "scanner": "scanner-primary", "fingerprint": "6fddd4c52f9cf9cd", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-be70f33d6cbb8af2", "level": "note", "message": {"text": "Legacy-named symbol `_start_legacy` in src/horus_os/adapters/discord_adapter.py:186"}, "properties": {"repobilityId": "40bd215a65798078", "scanner": "scanner-primary", "fingerprint": "be70f33d6cbb8af2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-fce165886be98e10", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/horus_os/adapters/base.py:221"}, "properties": {"repobilityId": "9b768d3823e79f61", "scanner": "scanner-primary", "fingerprint": "fce165886be98e10", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-33a4668d31a9b582", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/horus_os/adapters/otel_adapter.py:82"}, "properties": {"repobilityId": "70adb53fb7868801", "scanner": "scanner-primary", "fingerprint": "33a4668d31a9b582", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-70287fb2f35f4019", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/horus_os/cli/init_cmd.py:51"}, "properties": {"repobilityId": "5558f88f25a25424", "scanner": "scanner-primary", "fingerprint": "70287fb2f35f4019", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4e318e1a710013f2", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/horus_os/cli/serve_cmd.py:16"}, "properties": {"repobilityId": "b262fc22a0795c2d", "scanner": "scanner-primary", "fingerprint": "4e318e1a710013f2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-97e9c1343c03e838", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/horus_os/cli/run_cmd.py:90"}, "properties": {"repobilityId": "c0ede4e839f28689", "scanner": "scanner-primary", "fingerprint": "97e9c1343c03e838", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-be47c8f6e4979149", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/horus_os/cli/usage_cmd.py:50"}, "properties": {"repobilityId": "f04336b0b6e97518", "scanner": "scanner-primary", "fingerprint": "be47c8f6e4979149", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-10a27112100efc37", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/horus_os/observability/cost.py:55"}, "properties": {"repobilityId": "28b3cc62b3bbfa2c", "scanner": "scanner-primary", "fingerprint": "10a27112100efc37", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-67061707cfcc221c", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/horus_os/memory/notes.py:30"}, "properties": {"repobilityId": "873bc46bf363d82d", "scanner": "scanner-primary", "fingerprint": "67061707cfcc221c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4c6cd080b5edb386", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 src/horus_os/service/manager.py:61"}, "properties": {"repobilityId": "8ec20608bc45928c", "scanner": "scanner-primary", "fingerprint": "4c6cd080b5edb386", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-a0fdaacc142425d9", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/horus_os/server/api.py:29"}, "properties": {"repobilityId": "9259a0229330b4b4", "scanner": "scanner-primary", "fingerprint": "a0fdaacc142425d9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f30b43b53b096234", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/horus_os/tools/_ssrf.py:27"}, "properties": {"repobilityId": "e0ee68099ce84e14", "scanner": "scanner-primary", "fingerprint": "f30b43b53b096234", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c8a9247cbe7a2e45", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/horus_os/tools/shell.py:46"}, "properties": {"repobilityId": "97c95847559248c5", "scanner": "scanner-primary", "fingerprint": "c8a9247cbe7a2e45", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2fc62f98ee65ca7a", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/horus_os/seed/__init__.py:35"}, "properties": {"repobilityId": "704d991b57baa763", "scanner": "scanner-primary", "fingerprint": "2fc62f98ee65ca7a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-123bde923f828035", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/horus_os/plugins/capability_catalog.py:90"}, "properties": {"repobilityId": "a412e379962e2024", "scanner": "scanner-primary", "fingerprint": "123bde923f828035", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d488fac351be22b1", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/horus_os/plugins/api.py:172"}, "properties": {"repobilityId": "99f248bd9d991560", "scanner": "scanner-primary", "fingerprint": "d488fac351be22b1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-722b476e46bf042a", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/horus_os/plugins/installer.py:92"}, "properties": {"repobilityId": "99458e056e176104", "scanner": "scanner-primary", "fingerprint": "722b476e46bf042a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-414bcdcaa3bca111", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 src/horus_os/plugins/installer.py:169"}, "properties": {"repobilityId": "7b671ddc698a7d4d", "scanner": "scanner-primary", "fingerprint": "414bcdcaa3bca111", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "7cc07d7481de8cf7", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "c36df71526ac89e5", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "4d61f6085d633de6", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "67dc0ef364dfb53f", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "73213472e768e7cc", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "2b9e9ae23256a911", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "c2590627f8de4dd6", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "164985d5c63679af", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-02525d39071dd2c7", "level": "note", "message": {"text": "Near-duplicate function bodies in 5 places"}, "properties": {"repobilityId": "09ba80ab7e13c6f4", "scanner": "scanner-primary", "fingerprint": "02525d39071dd2c7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "9ced635881f5cb15", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "5b750b7f39cd44aa", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "bffc153ec7d11e14", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "aaae44ac8f9bc4d9", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "c5f7165f793c5792", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "547c50d9b8f1709d", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "54a71674de2b1cbd", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "f9e3c0dd06fe6779", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "0581cdb4e7e9e033", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "4382bbfb5eb0b1ff", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "4b86f9037cc201f7", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-53ea02c46c95a0d5", "level": "error", "message": {"text": "FastAPI POST `_handle_events` without auth dependency \u2014 src/horus_os/adapters/slack_adapter.py:128"}, "properties": {"repobilityId": "7b68e6ba2c1a44d6", "scanner": "scanner-primary", "fingerprint": "53ea02c46c95a0d5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/horus_os/adapters/slack_adapter.py"}, "region": {"startLine": 128}}}]}, {"ruleId": "scanner-ef0f01310b73c35b", "level": "error", "message": {"text": "FastAPI POST `_handle_commands` without auth dependency \u2014 src/horus_os/adapters/slack_adapter.py:156"}, "properties": {"repobilityId": "17e189f99b1d78be", "scanner": "scanner-primary", "fingerprint": "ef0f01310b73c35b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/horus_os/adapters/slack_adapter.py"}, "region": {"startLine": 156}}}]}, {"ruleId": "scanner-8007d5a41c142e82", "level": "error", "message": {"text": "FastAPI POST `_handle_webhook` without auth dependency \u2014 src/horus_os/adapters/webhook.py:65"}, "properties": {"repobilityId": "787772a420b93c7c", "scanner": "scanner-primary", "fingerprint": "8007d5a41c142e82", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/horus_os/adapters/webhook.py"}, "region": {"startLine": 65}}}]}, {"ruleId": "scanner-7481d74ebcfa19c0", "level": "error", "message": {"text": "FastAPI POST `_voice_complete` without auth dependency \u2014 src/horus_os/adapters/voice_adapter.py:288"}, "properties": {"repobilityId": "c153b96ad5dab7c8", "scanner": "scanner-primary", "fingerprint": "7481d74ebcfa19c0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/horus_os/adapters/voice_adapter.py"}, "region": {"startLine": 288}}}]}, {"ruleId": "scanner-48ed397775d97214", "level": "error", "message": {"text": "FastAPI POST `start_research` without auth dependency \u2014 src/horus_os/research/api.py:217"}, "properties": {"repobilityId": "252c581f54eeb97d", "scanner": "scanner-primary", "fingerprint": "48ed397775d97214", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/horus_os/research/api.py"}, "region": {"startLine": 217}}}]}, {"ruleId": "scanner-c2c66de400c7676b", "level": "error", "message": {"text": "FastAPI POST `confirm_research` without auth dependency \u2014 src/horus_os/research/api.py:286"}, "properties": {"repobilityId": "382d62ede962c0d8", "scanner": "scanner-primary", "fingerprint": "c2c66de400c7676b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/horus_os/research/api.py"}, "region": {"startLine": 286}}}]}, {"ruleId": "scanner-80b2685f20f8d32e", "level": "error", "message": {"text": "FastAPI POST `cancel_research` without auth dependency \u2014 src/horus_os/research/api.py:384"}, "properties": {"repobilityId": "171dffcf95047639", "scanner": "scanner-primary", "fingerprint": "80b2685f20f8d32e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/horus_os/research/api.py"}, "region": {"startLine": 384}}}]}, {"ruleId": "scanner-f3be59618d6eec31", "level": "error", "message": {"text": "FastAPI POST `enable_plugin` without auth dependency \u2014 src/horus_os/server/plugins_api.py:200"}, "properties": {"repobilityId": "fff1278d82ec515e", "scanner": "scanner-primary", "fingerprint": "f3be59618d6eec31", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/horus_os/server/plugins_api.py"}, "region": {"startLine": 200}}}]}, {"ruleId": "scanner-6659c568b0bfe29c", "level": "error", "message": {"text": "FastAPI POST `disable_plugin` without auth dependency \u2014 src/horus_os/server/plugins_api.py:210"}, "properties": {"repobilityId": "8909036e0e11cd9e", "scanner": "scanner-primary", "fingerprint": "6659c568b0bfe29c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/horus_os/server/plugins_api.py"}, "region": {"startLine": 210}}}]}, {"ruleId": "scanner-fb508fe473794252", "level": "error", "message": {"text": "FastAPI POST `grant_capability` without auth dependency \u2014 src/horus_os/server/plugins_api.py:220"}, "properties": {"repobilityId": "dcfdaef740adb2ec", "scanner": "scanner-primary", "fingerprint": "fb508fe473794252", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/horus_os/server/plugins_api.py"}, "region": {"startLine": 220}}}]}, {"ruleId": "scanner-5841c1c3a762972a", "level": "error", "message": {"text": "FastAPI DELETE `revoke_capability` without auth dependency \u2014 src/horus_os/server/plugins_api.py:264"}, "properties": {"repobilityId": "befea7440110c1c1", "scanner": "scanner-primary", "fingerprint": "5841c1c3a762972a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/horus_os/server/plugins_api.py"}, "region": {"startLine": 264}}}]}, {"ruleId": "scanner-f825b2c7c5a5f31b", "level": "error", "message": {"text": "FastAPI DELETE `delete_task` without auth dependency \u2014 src/horus_os/server/dashboard_api.py:327"}, "properties": {"repobilityId": "ec412091dfc2aeae", "scanner": "scanner-primary", "fingerprint": "f825b2c7c5a5f31b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/horus_os/server/dashboard_api.py"}, "region": {"startLine": 327}}}]}, {"ruleId": "scanner-2b274874b4d8d8c3", "level": "error", "message": {"text": "FastAPI DELETE `delete_trace` without auth dependency \u2014 src/horus_os/server/dashboard_api.py:342"}, "properties": {"repobilityId": "ef98a54a9e40135c", "scanner": "scanner-primary", "fingerprint": "2b274874b4d8d8c3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/horus_os/server/dashboard_api.py"}, "region": {"startLine": 342}}}]}, {"ruleId": "scanner-f4bb82009e7a33cb", "level": "error", "message": {"text": "FastAPI POST `post_integration_key` without auth dependency \u2014 src/horus_os/server/integrations_write.py:253"}, "properties": {"repobilityId": "db1a3ede97e5ebf2", "scanner": "scanner-primary", "fingerprint": "f4bb82009e7a33cb", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/horus_os/server/integrations_write.py"}, "region": {"startLine": 253}}}]}, {"ruleId": "scanner-d28f30807bc0f8de", "level": "error", "message": {"text": "FastAPI POST `post_integration_verify` without auth dependency \u2014 src/horus_os/server/integrations_write.py:292"}, "properties": {"repobilityId": "8ea58c189d34c23d", "scanner": "scanner-primary", "fingerprint": "d28f30807bc0f8de", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/horus_os/server/integrations_write.py"}, "region": {"startLine": 292}}}]}, {"ruleId": "scanner-997e8131208e239f", "level": "error", "message": {"text": "FastAPI POST `agents_create` without auth dependency \u2014 src/horus_os/server/api.py:600"}, "properties": {"repobilityId": "95524f141ffd5d6e", "scanner": "scanner-primary", "fingerprint": "997e8131208e239f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/horus_os/server/api.py"}, "region": {"startLine": 600}}}]}, {"ruleId": "scanner-a1cc7dde001cb0de", "level": "error", "message": {"text": "FastAPI PATCH `agents_edit` without auth dependency \u2014 src/horus_os/server/api.py:635"}, "properties": {"repobilityId": "62d278b9f094e12a", "scanner": "scanner-primary", "fingerprint": "a1cc7dde001cb0de", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/horus_os/server/api.py"}, "region": {"startLine": 635}}}]}, {"ruleId": "scanner-5bd1f0dd0816cfd8", "level": "error", "message": {"text": "FastAPI DELETE `agents_delete` without auth dependency \u2014 src/horus_os/server/api.py:665"}, "properties": {"repobilityId": "b74d93a3e3f0cce6", "scanner": "scanner-primary", "fingerprint": "5bd1f0dd0816cfd8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/horus_os/server/api.py"}, "region": {"startLine": 665}}}]}, {"ruleId": "scanner-9caea6131d8fe311", "level": "error", "message": {"text": "FastAPI POST `store_install` without auth dependency \u2014 src/horus_os/server/api.py:724"}, "properties": {"repobilityId": "87dda5412df5dccd", "scanner": "scanner-primary", "fingerprint": "9caea6131d8fe311", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/horus_os/server/api.py"}, "region": {"startLine": 724}}}]}, {"ruleId": "scanner-9f67fe0862c9f83a", "level": "error", "message": {"text": "FastAPI POST `upload` without auth dependency \u2014 src/horus_os/server/api.py:845"}, "properties": {"repobilityId": "83fc5729440a98e3", "scanner": "scanner-primary", "fingerprint": "9f67fe0862c9f83a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/horus_os/server/api.py"}, "region": {"startLine": 845}}}]}, {"ruleId": "scanner-16fe3898d75ff828", "level": "error", "message": {"text": "FastAPI POST `chat` without auth dependency \u2014 src/horus_os/server/api.py:902"}, "properties": {"repobilityId": "25bde49e8da71caf", "scanner": "scanner-primary", "fingerprint": "16fe3898d75ff828", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/horus_os/server/api.py"}, "region": {"startLine": 902}}}]}, {"ruleId": "scanner-fd9017ad88d29d1e", "level": "error", "message": {"text": "FastAPI POST `chat_stream` without auth dependency \u2014 src/horus_os/server/api.py:987"}, "properties": {"repobilityId": "2125b7a262455409", "scanner": "scanner-primary", "fingerprint": "fd9017ad88d29d1e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/horus_os/server/api.py"}, "region": {"startLine": 987}}}]}, {"ruleId": "scanner-6d28b527cb0302c6", "level": "error", "message": {"text": "FastAPI POST `disable_adapter` without auth dependency \u2014 src/horus_os/server/api.py:1167"}, "properties": {"repobilityId": "0d2cd9497dd2acca", "scanner": "scanner-primary", "fingerprint": "6d28b527cb0302c6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/horus_os/server/api.py"}, "region": {"startLine": 1167}}}]}, {"ruleId": "scanner-178229448daf8af5", "level": "error", "message": {"text": "FastAPI POST `enable_adapter` without auth dependency \u2014 src/horus_os/server/api.py:1197"}, "properties": {"repobilityId": "ea32e83b9545fef4", "scanner": "scanner-primary", "fingerprint": "178229448daf8af5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/horus_os/server/api.py"}, "region": {"startLine": 1197}}}]}, {"ruleId": "scanner-b102cdb893c921b8", "level": "error", "message": {"text": "Dangling fetch: GET /search-index.json (docs-site/components/SearchDialog.tsx:52)"}, "properties": {"repobilityId": "99b4352348669c2e", "scanner": "scanner-primary", "fingerprint": "b102cdb893c921b8", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-2d154b5561196c10", "level": "note", "message": {"text": "Unused endpoint: POST /api/adapters/slack/events"}, "properties": {"repobilityId": "7c85f37c0b036fc0", "scanner": "scanner-primary", "fingerprint": "2d154b5561196c10", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-feaa3149f632d131", "level": "note", "message": {"text": "Unused endpoint: POST /api/adapters/slack/commands"}, "properties": {"repobilityId": "d3ff36440a3a1689", "scanner": "scanner-primary", "fingerprint": "feaa3149f632d131", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b4ebe9a345c3e710", "level": "note", "message": {"text": "Unused endpoint: POST /api/adapters/webhook"}, "properties": {"repobilityId": "79af934745c9017c", "scanner": "scanner-primary", "fingerprint": "b4ebe9a345c3e710", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-44dae8f65542bc11", "level": "note", "message": {"text": "Unused endpoint: GET /api/adapters/voice/status"}, "properties": {"repobilityId": "ceb93f15adb68207", "scanner": "scanner-primary", "fingerprint": "44dae8f65542bc11", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b677ff24cc45497a", "level": "note", "message": {"text": "Unused endpoint: GET /api/adapters/voice/twiml"}, "properties": {"repobilityId": "9232d83048406d08", "scanner": "scanner-primary", "fingerprint": "b677ff24cc45497a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-515645c1290e3e46", "level": "note", "message": {"text": "Unused endpoint: POST /api/adapters/voice/calls/{record_id}/complete"}, "properties": {"repobilityId": "79e033de74619acc", "scanner": "scanner-primary", "fingerprint": "515645c1290e3e46", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a7cecc0d897343ea", "level": "note", "message": {"text": "Unused endpoint: POST /api/research"}, "properties": {"repobilityId": "e5a5acc1aec737ce", "scanner": "scanner-primary", "fingerprint": "a7cecc0d897343ea", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e61134ba1e6875ef", "level": "note", "message": {"text": "Unused endpoint: POST /api/research/{task_id}/start"}, "properties": {"repobilityId": "875d5c50dffa4fa1", "scanner": "scanner-primary", "fingerprint": "e61134ba1e6875ef", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-89dfdf3d67531283", "level": "note", "message": {"text": "Unused endpoint: GET /api/research/{task_id}/progress"}, "properties": {"repobilityId": "d062ecefb6f068ac", "scanner": "scanner-primary", "fingerprint": "89dfdf3d67531283", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b7fdfe30d8ba14eb", "level": "note", "message": {"text": "Unused endpoint: GET /api/research/{task_id}/report"}, "properties": {"repobilityId": "bc3d7ea70d8227b6", "scanner": "scanner-primary", "fingerprint": "b7fdfe30d8ba14eb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0fbd5defc965c2ea", "level": "note", "message": {"text": "Unused endpoint: POST /api/research/{task_id}/cancel"}, "properties": {"repobilityId": "8be795608e5845b2", "scanner": "scanner-primary", "fingerprint": "0fbd5defc965c2ea", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3e91f42808613291", "level": "note", "message": {"text": "Unused endpoint: GET /api/plugins"}, "properties": {"repobilityId": "fca36aed7b7ba32a", "scanner": "scanner-primary", "fingerprint": "3e91f42808613291", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-599000fe1a69bcea", "level": "note", "message": {"text": "Unused endpoint: GET /api/plugins/{name}"}, "properties": {"repobilityId": "dfc19c98ba065d4d", "scanner": "scanner-primary", "fingerprint": "599000fe1a69bcea", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cf0d63af15a4bd28", "level": "note", "message": {"text": "Unused endpoint: POST /api/plugins/{name}/enable"}, "properties": {"repobilityId": "fbc151477d6f8bc9", "scanner": "scanner-primary", "fingerprint": "cf0d63af15a4bd28", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1d41f28c374e92a0", "level": "note", "message": {"text": "Unused endpoint: POST /api/plugins/{name}/disable"}, "properties": {"repobilityId": "31a07157d5281221", "scanner": "scanner-primary", "fingerprint": "1d41f28c374e92a0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fd256bed4abab0a6", "level": "note", "message": {"text": "Unused endpoint: POST /api/plugins/{name}/grant"}, "properties": {"repobilityId": "e0663ef6368126a1", "scanner": "scanner-primary", "fingerprint": "fd256bed4abab0a6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a8edaf0e2153310d", "level": "note", "message": {"text": "Unused endpoint: DELETE /api/plugins/{name}/grant/{capability}"}, "properties": {"repobilityId": "a8267aef49d1568a", "scanner": "scanner-primary", "fingerprint": "a8edaf0e2153310d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5c519e593dfeb4e5", "level": "note", "message": {"text": "Unused endpoint: GET /api/observability/plugins"}, "properties": {"repobilityId": "247c7a09a4d6f107", "scanner": "scanner-primary", "fingerprint": "5c519e593dfeb4e5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2b1d988396924177", "level": "note", "message": {"text": "Unused endpoint: GET /api/team"}, "properties": {"repobilityId": "1d6f84848b6bd777", "scanner": "scanner-primary", "fingerprint": "2b1d988396924177", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8bc50c380a5b1078", "level": "note", "message": {"text": "Unused endpoint: GET /api/team/{name}"}, "properties": {"repobilityId": "4d535c35ac61022d", "scanner": "scanner-primary", "fingerprint": "8bc50c380a5b1078", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a74464b0f1216462", "level": "note", "message": {"text": "Unused endpoint: GET /api/memory"}, "properties": {"repobilityId": "962259ccbf66c8ad", "scanner": "scanner-primary", "fingerprint": "a74464b0f1216462", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7c96d3488e0d6843", "level": "note", "message": {"text": "Unused endpoint: GET /api/memory/note"}, "properties": {"repobilityId": "8c614cc8d3dcf428", "scanner": "scanner-primary", "fingerprint": "7c96d3488e0d6843", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d30aa36f85b5752f", "level": "note", "message": {"text": "Unused endpoint: GET /api/activity"}, "properties": {"repobilityId": "8746d813685c02e1", "scanner": "scanner-primary", "fingerprint": "d30aa36f85b5752f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cf16ae0930dc161a", "level": "note", "message": {"text": "Unused endpoint: GET /api/tasks"}, "properties": {"repobilityId": "4a05a54d8703346a", "scanner": "scanner-primary", "fingerprint": "cf16ae0930dc161a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cd3fec950f0a5169", "level": "note", "message": {"text": "Unused endpoint: DELETE /api/tasks/{task_id}"}, "properties": {"repobilityId": "5b82ddb87263f4f9", "scanner": "scanner-primary", "fingerprint": "cd3fec950f0a5169", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6c3159428d56e3fe", "level": "note", "message": {"text": "Unused endpoint: DELETE /api/traces/{trace_id}"}, "properties": {"repobilityId": "b84af904c3964950", "scanner": "scanner-primary", "fingerprint": "6c3159428d56e3fe", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4756b4c4da7d2088", "level": "note", "message": {"text": "Unused endpoint: GET /api/health"}, "properties": {"repobilityId": "c27384156105349b", "scanner": "scanner-primary", "fingerprint": "4756b4c4da7d2088", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-379b09f9de636500", "level": "note", "message": {"text": "Unused endpoint: GET /api/settings"}, "properties": {"repobilityId": "6ca4b221066cbe9b", "scanner": "scanner-primary", "fingerprint": "379b09f9de636500", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cae6664615b08cb4", "level": "note", "message": {"text": "Unused endpoint: GET /api/integrations"}, "properties": {"repobilityId": "d01eca9407b90bc8", "scanner": "scanner-primary", "fingerprint": "cae6664615b08cb4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-619909e7c6fb2b85", "level": "note", "message": {"text": "Unused endpoint: GET /api/integrations/vercel/status"}, "properties": {"repobilityId": "706e0e8ef3940bb7", "scanner": "scanner-primary", "fingerprint": "619909e7c6fb2b85", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-58e5c613f20a8bbe", "level": "note", "message": {"text": "Unused endpoint: POST /api/integrations/{name}/keys"}, "properties": {"repobilityId": "7f66a2efee6f0249", "scanner": "scanner-primary", "fingerprint": "58e5c613f20a8bbe", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f9a34f28ae8a9776", "level": "note", "message": {"text": "Unused endpoint: POST /api/integrations/{name}/verify"}, "properties": {"repobilityId": "934b49b7cfcc8753", "scanner": "scanner-primary", "fingerprint": "f9a34f28ae8a9776", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bebe76d0d0622914", "level": "note", "message": {"text": "Unused endpoint: GET /api/traces"}, "properties": {"repobilityId": "ef14ec4f2f6a6343", "scanner": "scanner-primary", "fingerprint": "bebe76d0d0622914", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b536835028fd6b62", "level": "note", "message": {"text": "Unused endpoint: GET /api/traces/{trace_id}"}, "properties": {"repobilityId": "79cd1f728cf12b8a", "scanner": "scanner-primary", "fingerprint": "b536835028fd6b62", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5eeb82d749239127", "level": "note", "message": {"text": "Unused endpoint: GET /api/traces/{trace_id}/children"}, "properties": {"repobilityId": "daffe35d744723c1", "scanner": "scanner-primary", "fingerprint": "5eeb82d749239127", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c4b0361ac0f5eeb9", "level": "note", "message": {"text": "Unused endpoint: GET /api/agents"}, "properties": {"repobilityId": "75d84dc28e574bef", "scanner": "scanner-primary", "fingerprint": "c4b0361ac0f5eeb9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d01a3a14b321e7d9", "level": "note", "message": {"text": "Unused endpoint: GET /api/agents/{name}"}, "properties": {"repobilityId": "5ef7630756ada010", "scanner": "scanner-primary", "fingerprint": "d01a3a14b321e7d9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ab31d7e480a710b2", "level": "note", "message": {"text": "Unused endpoint: POST /api/agents"}, "properties": {"repobilityId": "efbaaa8e58291317", "scanner": "scanner-primary", "fingerprint": "ab31d7e480a710b2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-62dedfc156b76f3b", "level": "note", "message": {"text": "Unused endpoint: PATCH /api/agents/{name}"}, "properties": {"repobilityId": "9ca473c4ee1be047", "scanner": "scanner-primary", "fingerprint": "62dedfc156b76f3b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f1d3968c92f01e06", "level": "note", "message": {"text": "Unused endpoint: DELETE /api/agents/{name}"}, "properties": {"repobilityId": "c6dbd8392519993c", "scanner": "scanner-primary", "fingerprint": "f1d3968c92f01e06", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e5f452a234411d7d", "level": "note", "message": {"text": "Unused endpoint: GET /api/agents/{name}/export"}, "properties": {"repobilityId": "42428379f1d8c27e", "scanner": "scanner-primary", "fingerprint": "e5f452a234411d7d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-35307ee713707cfa", "level": "note", "message": {"text": "Unused endpoint: GET /api/store"}, "properties": {"repobilityId": "cefafe65e6fd5304", "scanner": "scanner-primary", "fingerprint": "35307ee713707cfa", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-01d0b3fecce7bd16", "level": "note", "message": {"text": "Unused endpoint: GET /api/store/{slug}"}, "properties": {"repobilityId": "5d4dc2905f4bfb9c", "scanner": "scanner-primary", "fingerprint": "01d0b3fecce7bd16", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-93967f67ab3a108b", "level": "note", "message": {"text": "Unused endpoint: POST /api/store/{slug}/install"}, "properties": {"repobilityId": "15c6360681b7ba13", "scanner": "scanner-primary", "fingerprint": "93967f67ab3a108b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a871b15183a0df55", "level": "note", "message": {"text": "Unused endpoint: GET /api/writes"}, "properties": {"repobilityId": "b6bb4e36a18ad3c9", "scanner": "scanner-primary", "fingerprint": "a871b15183a0df55", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2faf9c471c2e38ea", "level": "note", "message": {"text": "Unused endpoint: GET /api/observability/cost"}, "properties": {"repobilityId": "7c7e78f38a202497", "scanner": "scanner-primary", "fingerprint": "2faf9c471c2e38ea", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b6b71072a8f10674", "level": "note", "message": {"text": "Unused endpoint: GET /api/observability/cost-by-model"}, "properties": {"repobilityId": "510743ac86764f24", "scanner": "scanner-primary", "fingerprint": "b6b71072a8f10674", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e527d6966ffe5345", "level": "note", "message": {"text": "Unused endpoint: GET /api/observability/latency"}, "properties": {"repobilityId": "79a99d945a3e1afe", "scanner": "scanner-primary", "fingerprint": "e527d6966ffe5345", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1a543f1d3234982e", "level": "note", "message": {"text": "Unused endpoint: GET /api/observability/tools"}, "properties": {"repobilityId": "f0e3db4ae60cd218", "scanner": "scanner-primary", "fingerprint": "1a543f1d3234982e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d0d720187ed71ba9", "level": "note", "message": {"text": "Unused endpoint: GET /api/observability/llm-calls"}, "properties": {"repobilityId": "1371a8aeb3d3cf57", "scanner": "scanner-primary", "fingerprint": "d0d720187ed71ba9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}