{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-cf3b7e3065fc75c6", "name": "Possibly dead Python function: s3_must_find", "shortDescription": {"text": "Possibly dead Python function: s3_must_find"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bead75b0f9233e05", "name": "No API endpoints detected", "shortDescription": {"text": "No API endpoints detected"}, "fullDescription": {"text": "The scanner did not find FastAPI/Flask/Express/NestJS/GraphQL/gRPC routes. If this repo exposes APIs, the framework may be unsupported."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2499c7cd6d532102", "name": "Stray `console.log` in TS/JS \u2014 evals/suites/chain/targets/app-focus-order-illogical/component.jsx:82", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 evals/suites/chain/targets/app-focus-order-illogical/component.jsx:82"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd441dc4e6e4a452", "name": "Icon-only button without accessible name \u2014 evals/suites/chain/targets/modal-broken-focus-trap/component.jsx:19", "shortDescription": {"text": "Icon-only button without accessible name \u2014 evals/suites/chain/targets/modal-broken-focus-trap/component.jsx:19"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-050b4e0fa0e5ff6f", "name": "Possible secret in evals/suites/chain/targets/login-form-clean/component.jsx", "shortDescription": {"text": "Possible secret in evals/suites/chain/targets/login-form-clean/component.jsx"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-b4e23ec15c371fad", "name": "Insecure pattern 'dangerous_innerhtml' in evals/suites/a11y-planner/rubrics/sr-article-page.rubric.yaml:118", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in evals/suites/a11y-planner/rubrics/sr-article-page.rubric.yaml:118"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c7c6f5db0f4bad26", "name": "Insecure pattern 'dangerous_innerhtml' in evals/results/codex-planner/codex-bench-planner-sr-article-page-55low-response", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in evals/results/codex-planner/codex-bench-planner-sr-article-page-55low-response.json:2"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a90ecbf73466fd37", "name": "Insecure pattern 'dangerous_innerhtml' in evals/results/claude-planner/claude-planner-sr-article-page-opus-response.json", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in evals/results/claude-planner/claude-planner-sr-article-page-opus-response.json:2"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-be84dfe219bba075", "name": "Insecure pattern 'eval_used' in plans/README.md:32", "shortDescription": {"text": "Insecure pattern 'eval_used' in plans/README.md:32"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e4f658c0c00de0d4", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/deploy-pages@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-448d8837178ae57a", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "2 test file(s) for 27 source file(s) (ratio 0.07). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 326 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a1fc994f976ab85f", "name": "Agent authority lacks a verifier contract: .claude/agents/bench-runner.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agents/bench-runner.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bcbe7efea8e0b833", "name": "Agent authority lacks a verifier contract: .claude/agents/perspective-audit.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agents/perspective-audit.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9b548747bf5abbd", "name": "Agent authority lacks a verifier contract: .claude/agents/a11y-scout.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/agents/a11y-scout.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-af28f3231e325581", "name": "Agent authority lacks a verifier contract: .claude/skills/a11y-critic/references/external-skills-manifest.yaml", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/a11y-critic/references/external-skills-manifest.yaml"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e725d2ab884fbd49", "name": "Multiple root agent instruction files without precedence", "shortDescription": {"text": "Multiple root agent instruction files without precedence"}, "fullDescription": {"text": "The repo has multiple top-level AI-coder instruction files. Without precedence rules, different agents may follow different policies."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-60a22b97416203c8", "name": "Commented-code block (6 lines) in evals/suites/chain/score_chain.py:33", "shortDescription": {"text": "Commented-code block (6 lines) in evals/suites/chain/score_chain.py:33"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9c9b6e81627a0554", "name": "Commented-code block (9 lines) in evals/suites/webwright-benchmark/task-3a-dialog/final_runs/run_1/final_script.py:173", "shortDescription": {"text": "Commented-code block (9 lines) in evals/suites/webwright-benchmark/task-3a-dialog/final_runs/run_1/final_script.py:173"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1b70780e035a470c", "name": "Commented-code block (5 lines) in ollama/score_common.py:4", "shortDescription": {"text": "Commented-code block (5 lines) in ollama/score_common.py:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9f23a87ba575538d", "name": "Network/subprocess call without timeout or try/except \u2014 ollama/run_benchmark.py:541", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 ollama/run_benchmark.py:541"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6e8bcd0db70f68f5", "name": "Commented-code block (7 lines) in ollama/run_cloud_benchmark.py:553", "shortDescription": {"text": "Commented-code block (7 lines) in ollama/run_cloud_benchmark.py:553"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fa6a747b7d981f52", "name": "Network/subprocess call without timeout or try/except \u2014 ollama/run_cloud_benchmark.py:739", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 ollama/run_cloud_benchmark.py:739"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nollama/score_planner.py:load_response, ollama/score_perspective.py:load_response, ollama/score_output.py:load_response\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nollama/score_perspective.py:score, ollama/score_output.py:score\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/23684"}, "properties": {"repository": "zivtech/a11y-meta-skills", "repoUrl": "https://github.com/zivtech/a11y-meta-skills", "branch": "main"}, "results": [{"ruleId": "scanner-cf3b7e3065fc75c6", "level": "note", "message": {"text": "Possibly dead Python function: s3_must_find"}, "properties": {"repobilityId": "b0d2a5877a05158f", "scanner": "scanner-primary", "fingerprint": "cf3b7e3065fc75c6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "evals/suites/chain/score_chain.py:162"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bead75b0f9233e05", "level": "none", "message": {"text": "No API endpoints detected"}, "properties": {"repobilityId": "0f8bb852027c38f8", "scanner": "scanner-primary", "fingerprint": "bead75b0f9233e05", "layer": "api", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-2499c7cd6d532102", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 evals/suites/chain/targets/app-focus-order-illogical/component.jsx:82"}, "properties": {"repobilityId": "5c77640742429562", "scanner": "scanner-primary", "fingerprint": "2499c7cd6d532102", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-fd441dc4e6e4a452", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 evals/suites/chain/targets/modal-broken-focus-trap/component.jsx:19"}, "properties": {"repobilityId": "16ca7f02cc53f91b", "scanner": "scanner-primary", "fingerprint": "fd441dc4e6e4a452", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-050b4e0fa0e5ff6f", "level": "error", "message": {"text": "Possible secret in evals/suites/chain/targets/login-form-clean/component.jsx"}, "properties": {"repobilityId": "4edf62fc0d67c908", "scanner": "scanner-primary", "fingerprint": "050b4e0fa0e5ff6f", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "evals/suites/chain/targets/login-form-clean/component.jsx"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-050b4e0fa0e5ff6f", "level": "error", "message": {"text": "Possible secret in evals/suites/chain/targets/login-form-clean/component.jsx"}, "properties": {"repobilityId": "4edf62fc0d67c908", "scanner": "scanner-primary", "fingerprint": "050b4e0fa0e5ff6f", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "evals/suites/chain/targets/login-form-clean/component.jsx"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-b4e23ec15c371fad", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in evals/suites/a11y-planner/rubrics/sr-article-page.rubric.yaml:118"}, "properties": {"repobilityId": "1e52d9486c9f5153", "scanner": "scanner-primary", "fingerprint": "b4e23ec15c371fad", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "evals/suites/a11y-planner/rubrics/sr-article-page.rubric.yaml"}, "region": {"startLine": 118}}}]}, {"ruleId": "scanner-c7c6f5db0f4bad26", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in evals/results/codex-planner/codex-bench-planner-sr-article-page-55low-response.json:2"}, "properties": {"repobilityId": "b4f43f39d3998aad", "scanner": "scanner-primary", "fingerprint": "c7c6f5db0f4bad26", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "evals/results/codex-planner/codex-bench-planner-sr-article-page-55low-response.json"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-a90ecbf73466fd37", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in evals/results/claude-planner/claude-planner-sr-article-page-opus-response.json:2"}, "properties": {"repobilityId": "0a40235c77405266", "scanner": "scanner-primary", "fingerprint": "a90ecbf73466fd37", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "evals/results/claude-planner/claude-planner-sr-article-page-opus-response.json"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-be84dfe219bba075", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in plans/README.md:32"}, "properties": {"repobilityId": "2c98458c96e6efc1", "scanner": "scanner-primary", "fingerprint": "be84dfe219bba075", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plans/README.md"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-e4f658c0c00de0d4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "25e1fa3783e7cb32", "scanner": "scanner-primary", "fingerprint": "e4f658c0c00de0d4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-448d8837178ae57a", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "13af6451e15656fc", "scanner": "scanner-primary", "fingerprint": "448d8837178ae57a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "b7d2bdd99866b804", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "79e2b373933adb7e", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "2a927519a060500a", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "750165e09f980333", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-a1fc994f976ab85f", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agents/bench-runner.md"}, "properties": {"repobilityId": "ea02681d0ea14712", "scanner": "scanner-primary", "fingerprint": "a1fc994f976ab85f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/bench-runner.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bcbe7efea8e0b833", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agents/perspective-audit.md"}, "properties": {"repobilityId": "93ce683e88f6521d", "scanner": "scanner-primary", "fingerprint": "bcbe7efea8e0b833", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/perspective-audit.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b9b548747bf5abbd", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/agents/a11y-scout.md"}, "properties": {"repobilityId": "89291e1b9caec11d", "scanner": "scanner-primary", "fingerprint": "b9b548747bf5abbd", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/a11y-scout.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-af28f3231e325581", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/a11y-critic/references/external-skills-manifest.yaml"}, "properties": {"repobilityId": "c6d8db9d69919119", "scanner": "scanner-primary", "fingerprint": "af28f3231e325581", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/a11y-critic/references/external-skills-manifest.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e725d2ab884fbd49", "level": "note", "message": {"text": "Multiple root agent instruction files without precedence"}, "properties": {"repobilityId": "1953db6c89508d22", "scanner": "scanner-primary", "fingerprint": "e725d2ab884fbd49", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["agent-instructions", "governance"]}}, {"ruleId": "scanner-60a22b97416203c8", "level": "none", "message": {"text": "Commented-code block (6 lines) in evals/suites/chain/score_chain.py:33"}, "properties": {"repobilityId": "e85d493124eb7817", "scanner": "scanner-primary", "fingerprint": "60a22b97416203c8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9c9b6e81627a0554", "level": "none", "message": {"text": "Commented-code block (9 lines) in evals/suites/webwright-benchmark/task-3a-dialog/final_runs/run_1/final_script.py:173"}, "properties": {"repobilityId": "09553dbe733cbd12", "scanner": "scanner-primary", "fingerprint": "9c9b6e81627a0554", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1b70780e035a470c", "level": "none", "message": {"text": "Commented-code block (5 lines) in ollama/score_common.py:4"}, "properties": {"repobilityId": "9533b78a380207f6", "scanner": "scanner-primary", "fingerprint": "1b70780e035a470c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9f23a87ba575538d", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 ollama/run_benchmark.py:541"}, "properties": {"repobilityId": "91cd0591de8d52a2", "scanner": "scanner-primary", "fingerprint": "9f23a87ba575538d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-6e8bcd0db70f68f5", "level": "none", "message": {"text": "Commented-code block (7 lines) in ollama/run_cloud_benchmark.py:553"}, "properties": {"repobilityId": "e5aa45882f5f1f5e", "scanner": "scanner-primary", "fingerprint": "6e8bcd0db70f68f5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fa6a747b7d981f52", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 ollama/run_cloud_benchmark.py:739"}, "properties": {"repobilityId": "11edddde3f34b1ab", "scanner": "scanner-primary", "fingerprint": "fa6a747b7d981f52", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "de13383a2c890d98", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "22557b7936290f6a", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "b5602d13cfe90fe0", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "8e38d634cca80109", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "fb0ff1b052448b3d", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "17b5a277ef47aeb4", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "31e3f04c4916d515", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "5d776746161fb25a", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}]}]}