{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-d63da3583b14afc0", "name": "Dockerfile runs as root: Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e066691601852931", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-656df7598724f72f", "name": "Insecure pattern 'local_storage_auth_token' in index.html:938", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in index.html:938"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-83d639868097d628", "name": "Insecure pattern 'direct_innerhtml_assignment' in preview.html:2451", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in preview.html:2451"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e4f658c0c00de0d4", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-448d8837178ae57a", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-58427d8e38cb51ca", "name": "Very large file: server.py (6501 lines)", "shortDescription": {"text": "Very large file: server.py (6501 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "2 tests / 12 src (ratio 0.17)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 160 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-11825279136b53a3", "name": "CI is configured but no tests are detected", "shortDescription": {"text": "CI is configured but no tests are detected"}, "fullDescription": {"text": "A CI pipeline exists, but the scan found no test files to gate. Opus labeled this generated-code pattern as config theater: release machinery exists, but it has little behavioral signal."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, tests. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-19f65319fd817266", "name": "Legacy-named symbol `backtest_v2` in verify_data_layer.py:17", "shortDescription": {"text": "Legacy-named symbol `backtest_v2` in verify_data_layer.py:17"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-19c6d3f5db238448", "name": "Legacy-named symbol `backtest_v2` in backtest_v2.py:3", "shortDescription": {"text": "Legacy-named symbol `backtest_v2` in backtest_v2.py:3"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-75c7fbafe8ad4a01", "name": "Commented-code block (7 lines) in backtest_v2.py:495", "shortDescription": {"text": "Commented-code block (7 lines) in backtest_v2.py:495"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-72764f22750d90d9", "name": "Commented-code block (5 lines) in signal_scalper.py:149", "shortDescription": {"text": "Commented-code block (5 lines) in signal_scalper.py:149"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c371778ce61d8faa", "name": "Legacy-named symbol `signal_v2` in signal_orb.py:39", "shortDescription": {"text": "Legacy-named symbol `signal_v2` in signal_orb.py:39"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c322eb062b6ac15d", "name": "Commented-code block (5 lines) in signal_orb.py:70", "shortDescription": {"text": "Commented-code block (5 lines) in signal_orb.py:70"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4a622b5b1735718b", "name": "Legacy-named symbol `signal_v2` in signal_reverter.py:56", "shortDescription": {"text": "Legacy-named symbol `signal_v2` in signal_reverter.py:56"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0a166712d6cb2b31", "name": "Legacy-named symbol `dry_run_v2` in server.py:127", "shortDescription": {"text": "Legacy-named symbol `dry_run_v2` in server.py:127"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cc2ba88c5be3bd32", "name": "Commented-code block (8 lines) in server.py:50", "shortDescription": {"text": "Commented-code block (8 lines) in server.py:50"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b132ddcdeada8c57", "name": "Legacy-named symbol `signal_v2` in signal_v2.py:3", "shortDescription": {"text": "Legacy-named symbol `signal_v2` in signal_v2.py:3"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-571e30c2f0b8a951", "name": "Commented-code block (5 lines) in signal_v2.py:169", "shortDescription": {"text": "Commented-code block (5 lines) in signal_v2.py:169"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-17849a114e78d11b", "name": "Legacy-named symbol `backtest_v2` in data_layer.py:196", "shortDescription": {"text": "Legacy-named symbol `backtest_v2` in data_layer.py:196"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8613b2656d98ffaa", "name": "Commented-code block (8 lines) in data_layer.py:398", "shortDescription": {"text": "Commented-code block (8 lines) in data_layer.py:398"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c99bbcf3186fe557", "name": "Legacy-named symbol `backtest_v2` in conductor.py:109", "shortDescription": {"text": "Legacy-named symbol `backtest_v2` in conductor.py:109"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1e733aabacdedcee", "name": "Commented-code block (6 lines) in conductor.py:389", "shortDescription": {"text": "Commented-code block (6 lines) in conductor.py:389"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-45e2064a236a71f1", "name": "Commented-code block (7 lines) in regime.py:56", "shortDescription": {"text": "Commented-code block (7 lines) in regime.py:56"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5c41bb1a1f430bd6", "name": "39 env vars used in code but missing from .env.example", "shortDescription": {"text": "39 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `ANTHROPIC_CACHE_ENABLED`, `ANTHROPIC_MODEL`, `ANTHROPIC_MODEL_INFLIGHT`, `AUTH_TOKEN`, `AUTO_CLOSE_HOUR`, `AUTO_CLOSE_MINUTE`, `BROKERAGE_PER_LOT`, `BUDGET` + 31 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nsignal_nifty_regime.py:analyze, signal_nifty_regime.py:analyze\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49c98f7cedd9c977", "name": "Near-duplicate function bodies in 4 places", "shortDescription": {"text": "Near-duplicate function bodies in 4 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nserver.py:analyze, server.py:analyze, server.py:analyze, server.py:analyze\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nserver.py:start, server.py:start, server.py:start\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1a6d91f2236825bf", "name": "Unused endpoint: ANY /", "shortDescription": {"text": "Unused endpoint: ANY /"}, "fullDescription": {"text": "`server.py` declares `ANY /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8877994083ed2902", "name": "Unused endpoint: ANY /dashboard", "shortDescription": {"text": "Unused endpoint: ANY /dashboard"}, "fullDescription": {"text": "`server.py` declares `ANY /dashboard` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cee1b1903574e9ca", "name": "Unused endpoint: ANY /api/login", "shortDescription": {"text": "Unused endpoint: ANY /api/login"}, "fullDescription": {"text": "`server.py` declares `ANY /api/login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1a4c8583bec688c4", "name": "Unused endpoint: ANY /api/diag", "shortDescription": {"text": "Unused endpoint: ANY /api/diag"}, "fullDescription": {"text": "`server.py` declares `ANY /api/diag` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-29da11cb7e714ca0", "name": "Unused endpoint: ANY /api/ltp", "shortDescription": {"text": "Unused endpoint: ANY /api/ltp"}, "fullDescription": {"text": "`server.py` declares `ANY /api/ltp` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7afd038ccf65a46c", "name": "Unused endpoint: ANY /api/historical/<instrument>", "shortDescription": {"text": "Unused endpoint: ANY /api/historical/<instrument>"}, "fullDescription": {"text": "`server.py` declares `ANY /api/historical/<instrument>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d87d1b555a41341a", "name": "Unused endpoint: ANY /api/ping", "shortDescription": {"text": "Unused endpoint: ANY /api/ping"}, "fullDescription": {"text": "`server.py` declares `ANY /api/ping` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e1a61ead29e17012", "name": "Unused endpoint: ANY /api/status", "shortDescription": {"text": "Unused endpoint: ANY /api/status"}, "fullDescription": {"text": "`server.py` declares `ANY /api/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8cf85f094bce9507", "name": "Unused endpoint: ANY /api/start", "shortDescription": {"text": "Unused endpoint: ANY /api/start"}, "fullDescription": {"text": "`server.py` declares `ANY /api/start` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-29ed6dd1feb3d89e", "name": "Unused endpoint: ANY /api/stop", "shortDescription": {"text": "Unused endpoint: ANY /api/stop"}, "fullDescription": {"text": "`server.py` declares `ANY /api/stop` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2f861c56919f1e02", "name": "Unused endpoint: ANY /api/backtest", "shortDescription": {"text": "Unused endpoint: ANY /api/backtest"}, "fullDescription": {"text": "`server.py` declares `ANY /api/backtest` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5aa782149490aa2f", "name": "Unused endpoint: ANY /api/backtest/jobs/<job_id>", "shortDescription": {"text": "Unused endpoint: ANY /api/backtest/jobs/<job_id>"}, "fullDescription": {"text": "`server.py` declares `ANY /api/backtest/jobs/<job_id>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-36d677a7715b9807", "name": "Unused endpoint: ANY /api/config", "shortDescription": {"text": "Unused endpoint: ANY /api/config"}, "fullDescription": {"text": "`server.py` declares `ANY /api/config` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-87536038ad543230", "name": "Unused endpoint: ANY /api/history", "shortDescription": {"text": "Unused endpoint: ANY /api/history"}, "fullDescription": {"text": "`server.py` declares `ANY /api/history` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d0326c1b1c092510", "name": "Unused endpoint: ANY /api/performance", "shortDescription": {"text": "Unused endpoint: ANY /api/performance"}, "fullDescription": {"text": "`server.py` declares `ANY /api/performance` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bef334c0bc4b2337", "name": "Unused endpoint: ANY /api/chain/<instrument>", "shortDescription": {"text": "Unused endpoint: ANY /api/chain/<instrument>"}, "fullDescription": {"text": "`server.py` declares `ANY /api/chain/<instrument>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0d66d4c02876895a", "name": "Unused endpoint: ANY /api/option-ltp", "shortDescription": {"text": "Unused endpoint: ANY /api/option-ltp"}, "fullDescription": {"text": "`server.py` declares `ANY /api/option-ltp` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4f9a9d9aa2e0fafa", "name": "Unused endpoint: ANY /api/test-slack", "shortDescription": {"text": "Unused endpoint: ANY /api/test-slack"}, "fullDescription": {"text": "`server.py` declares `ANY /api/test-slack` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a973fb94fa92388", "name": "Unused endpoint: ANY /api/test-chain/<name>", "shortDescription": {"text": "Unused endpoint: ANY /api/test-chain/<name>"}, "fullDescription": {"text": "`server.py` declares `ANY /api/test-chain/<name>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-38f0949469c8c48e", "name": "Unused endpoint: ANY /api/metrics", "shortDescription": {"text": "Unused endpoint: ANY /api/metrics"}, "fullDescription": {"text": "`server.py` declares `ANY /api/metrics` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-43674568b2edbc10", "name": "Unused endpoint: ANY /api/signals/<int:sig_id>/void", "shortDescription": {"text": "Unused endpoint: ANY /api/signals/<int:sig_id>/void"}, "fullDescription": {"text": "`server.py` declares `ANY /api/signals/<int:sig_id>/void` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5e1adb962ba0d574", "name": "Unused endpoint: ANY /api/killswitch", "shortDescription": {"text": "Unused endpoint: ANY /api/killswitch"}, "fullDescription": {"text": "`server.py` declares `ANY /api/killswitch` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ff25b5bbf13a3d4b", "name": "Unused endpoint: ANY /api/strategy", "shortDescription": {"text": "Unused endpoint: ANY /api/strategy"}, "fullDescription": {"text": "`server.py` declares `ANY /api/strategy` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f92455eea6ee9db8", "name": "Unused endpoint: ANY /api/replay-premium", "shortDescription": {"text": "Unused endpoint: ANY /api/replay-premium"}, "fullDescription": {"text": "`server.py` declares `ANY /api/replay-premium` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a4b20057d47e2fee", "name": "Unused endpoint: ANY /api/v2-diag", "shortDescription": {"text": "Unused endpoint: ANY /api/v2-diag"}, "fullDescription": {"text": "`server.py` declares `ANY /api/v2-diag` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b8c7fbe3b6f930a3", "name": "Unused endpoint: ANY /api/swing/status", "shortDescription": {"text": "Unused endpoint: ANY /api/swing/status"}, "fullDescription": {"text": "`server.py` declares `ANY /api/swing/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-76fa192f4da00992", "name": "Unused endpoint: ANY /api/swing/positions", "shortDescription": {"text": "Unused endpoint: ANY /api/swing/positions"}, "fullDescription": {"text": "`server.py` declares `ANY /api/swing/positions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ca43ae918d3d9b6", "name": "Unused endpoint: ANY /api/swing/positions/<int:pos_id>", "shortDescription": {"text": "Unused endpoint: ANY /api/swing/positions/<int:pos_id>"}, "fullDescription": {"text": "`server.py` declares `ANY /api/swing/positions/<int:pos_id>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5d020acba7423aa5", "name": "Unused endpoint: ANY /api/swing/exit-analysis", "shortDescription": {"text": "Unused endpoint: ANY /api/swing/exit-analysis"}, "fullDescription": {"text": "`server.py` declares `ANY /api/swing/exit-analysis` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-002e9ef22ec0680b", "name": "Unused endpoint: ANY /api/swing/exit-analysis/<int:pos_id>", "shortDescription": {"text": "Unused endpoint: ANY /api/swing/exit-analysis/<int:pos_id>"}, "fullDescription": {"text": "`server.py` declares `ANY /api/swing/exit-analysis/<int:pos_id>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4214d829dae604a6", "name": "Unused endpoint: ANY /api/swing/save-signal", "shortDescription": {"text": "Unused endpoint: ANY /api/swing/save-signal"}, "fullDescription": {"text": "`server.py` declares `ANY /api/swing/save-signal` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/22817"}, "properties": {"repository": "wketan/Intraday", "repoUrl": "https://github.com/wketan/Intraday", "branch": "main"}, "results": [{"ruleId": "scanner-d63da3583b14afc0", "level": "warning", "message": {"text": "Dockerfile runs as root: Dockerfile"}, "properties": {"repobilityId": "a2ed1bd120e507db", "scanner": "scanner-primary", "fingerprint": "d63da3583b14afc0", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-e066691601852931", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "e89fda487f83bf34", "scanner": "scanner-primary", "fingerprint": "e066691601852931", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-656df7598724f72f", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in index.html:938"}, "properties": {"repobilityId": "8f2a167064b03ceb", "scanner": "scanner-primary", "fingerprint": "656df7598724f72f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "index.html"}, "region": {"startLine": 938}}}]}, {"ruleId": "scanner-83d639868097d628", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in preview.html:2451"}, "properties": {"repobilityId": "852b797ac3bbf31e", "scanner": "scanner-primary", "fingerprint": "83d639868097d628", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "preview.html"}, "region": {"startLine": 2451}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-e4f658c0c00de0d4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0fb8c24a130cdd0a", "scanner": "scanner-primary", "fingerprint": "e4f658c0c00de0d4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-e4f658c0c00de0d4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "38cf1c8b667d348e", "scanner": "scanner-primary", "fingerprint": "e4f658c0c00de0d4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-e4f658c0c00de0d4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7b2f6f2d816930a2", "scanner": "scanner-primary", "fingerprint": "e4f658c0c00de0d4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-e4f658c0c00de0d4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "25e1fa3783e7cb32", "scanner": "scanner-primary", "fingerprint": "e4f658c0c00de0d4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-448d8837178ae57a", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "13af6451e15656fc", "scanner": "scanner-primary", "fingerprint": "448d8837178ae57a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-58427d8e38cb51ca", "level": "note", "message": {"text": "Very large file: server.py (6501 lines)"}, "properties": {"repobilityId": "61d8058d744c856e", "scanner": "scanner-primary", "fingerprint": "58427d8e38cb51ca", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "5d4a3c499713dab3", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "874a0a87053c1d82", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "43fbf450e3a6f2d6", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-11825279136b53a3", "level": "warning", "message": {"text": "CI is configured but no tests are detected"}, "properties": {"repobilityId": "54a7b6c7ef9512da", "scanner": "scanner-primary", "fingerprint": "11825279136b53a3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "ci", "config-theater", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "8698e40bfa779081", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "303f259efa07c2fe", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "b07b6f4a4010656f", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-19f65319fd817266", "level": "note", "message": {"text": "Legacy-named symbol `backtest_v2` in verify_data_layer.py:17"}, "properties": {"repobilityId": "21035ebdb2164bc5", "scanner": "scanner-primary", "fingerprint": "19f65319fd817266", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-19c6d3f5db238448", "level": "note", "message": {"text": "Legacy-named symbol `backtest_v2` in backtest_v2.py:3"}, "properties": {"repobilityId": "f2dba1398ef4d3b5", "scanner": "scanner-primary", "fingerprint": "19c6d3f5db238448", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-75c7fbafe8ad4a01", "level": "none", "message": {"text": "Commented-code block (7 lines) in backtest_v2.py:495"}, "properties": {"repobilityId": "10ed5313db2152a0", "scanner": "scanner-primary", "fingerprint": "75c7fbafe8ad4a01", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-72764f22750d90d9", "level": "none", "message": {"text": "Commented-code block (5 lines) in signal_scalper.py:149"}, "properties": {"repobilityId": "e71e63ee796115ad", "scanner": "scanner-primary", "fingerprint": "72764f22750d90d9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c371778ce61d8faa", "level": "note", "message": {"text": "Legacy-named symbol `signal_v2` in signal_orb.py:39"}, "properties": {"repobilityId": "9922694c38014f4b", "scanner": "scanner-primary", "fingerprint": "c371778ce61d8faa", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-c322eb062b6ac15d", "level": "none", "message": {"text": "Commented-code block (5 lines) in signal_orb.py:70"}, "properties": {"repobilityId": "29d2d59c69ab3d62", "scanner": "scanner-primary", "fingerprint": "c322eb062b6ac15d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4a622b5b1735718b", "level": "note", "message": {"text": "Legacy-named symbol `signal_v2` in signal_reverter.py:56"}, "properties": {"repobilityId": "4872d52a7f802983", "scanner": "scanner-primary", "fingerprint": "4a622b5b1735718b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-0a166712d6cb2b31", "level": "note", "message": {"text": "Legacy-named symbol `dry_run_v2` in server.py:127"}, "properties": {"repobilityId": "f2791c45ade1dead", "scanner": "scanner-primary", "fingerprint": "0a166712d6cb2b31", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-cc2ba88c5be3bd32", "level": "none", "message": {"text": "Commented-code block (8 lines) in server.py:50"}, "properties": {"repobilityId": "226c023f33c84006", "scanner": "scanner-primary", "fingerprint": "cc2ba88c5be3bd32", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b132ddcdeada8c57", "level": "note", "message": {"text": "Legacy-named symbol `signal_v2` in signal_v2.py:3"}, "properties": {"repobilityId": "3526ffe555cb71d3", "scanner": "scanner-primary", "fingerprint": "b132ddcdeada8c57", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-571e30c2f0b8a951", "level": "none", "message": {"text": "Commented-code block (5 lines) in signal_v2.py:169"}, "properties": {"repobilityId": "f4527b03ec9750d2", "scanner": "scanner-primary", "fingerprint": "571e30c2f0b8a951", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-17849a114e78d11b", "level": "note", "message": {"text": "Legacy-named symbol `backtest_v2` in data_layer.py:196"}, "properties": {"repobilityId": "febc0114d3d465fe", "scanner": "scanner-primary", "fingerprint": "17849a114e78d11b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-8613b2656d98ffaa", "level": "none", "message": {"text": "Commented-code block (8 lines) in data_layer.py:398"}, "properties": {"repobilityId": "f6d3feba22d7e89e", "scanner": "scanner-primary", "fingerprint": "8613b2656d98ffaa", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c99bbcf3186fe557", "level": "note", "message": {"text": "Legacy-named symbol `backtest_v2` in conductor.py:109"}, "properties": {"repobilityId": "f36b26923c4a1ac9", "scanner": "scanner-primary", "fingerprint": "c99bbcf3186fe557", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-1e733aabacdedcee", "level": "none", "message": {"text": "Commented-code block (6 lines) in conductor.py:389"}, "properties": {"repobilityId": "89a31715d1b04090", "scanner": "scanner-primary", "fingerprint": "1e733aabacdedcee", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-45e2064a236a71f1", "level": "none", "message": {"text": "Commented-code block (7 lines) in regime.py:56"}, "properties": {"repobilityId": "cb475d08efa00206", "scanner": "scanner-primary", "fingerprint": "45e2064a236a71f1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5c41bb1a1f430bd6", "level": "note", "message": {"text": "39 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "4a6a9acd19ef8277", "scanner": "scanner-primary", "fingerprint": "5c41bb1a1f430bd6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "0d0d6f5541cfc12f", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "fd2fd82096471e6e", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "2a04d0f027547948", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "4406db9abdeb9540", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "ef9b5e0fb0dcb190", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "fd6aa1c6291e2504", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "68d5bbf7a68d40fd", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "4ccf951d826b2dd9", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "a1ea90164610d380", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-1a6d91f2236825bf", "level": "note", "message": {"text": "Unused endpoint: ANY /"}, "properties": {"repobilityId": "acd87918fd42fe63", "scanner": "scanner-primary", "fingerprint": "1a6d91f2236825bf", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8877994083ed2902", "level": "note", "message": {"text": "Unused endpoint: ANY /dashboard"}, "properties": {"repobilityId": "54d37e8b04ee9840", "scanner": "scanner-primary", "fingerprint": "8877994083ed2902", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cee1b1903574e9ca", "level": "note", "message": {"text": "Unused endpoint: ANY /api/login"}, "properties": {"repobilityId": "ba724689792ff562", "scanner": "scanner-primary", "fingerprint": "cee1b1903574e9ca", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1a4c8583bec688c4", "level": "note", "message": {"text": "Unused endpoint: ANY /api/diag"}, "properties": {"repobilityId": "31b0f48019201688", "scanner": "scanner-primary", "fingerprint": "1a4c8583bec688c4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-29da11cb7e714ca0", "level": "note", "message": {"text": "Unused endpoint: ANY /api/ltp"}, "properties": {"repobilityId": "b56662f66de01006", "scanner": "scanner-primary", "fingerprint": "29da11cb7e714ca0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7afd038ccf65a46c", "level": "note", "message": {"text": "Unused endpoint: ANY /api/historical/<instrument>"}, "properties": {"repobilityId": "e24ec20201d169d2", "scanner": "scanner-primary", "fingerprint": "7afd038ccf65a46c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d87d1b555a41341a", "level": "note", "message": {"text": "Unused endpoint: ANY /api/ping"}, "properties": {"repobilityId": "46d9ca1bf5d83e4a", "scanner": "scanner-primary", "fingerprint": "d87d1b555a41341a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e1a61ead29e17012", "level": "note", "message": {"text": "Unused endpoint: ANY /api/status"}, "properties": {"repobilityId": "a022f1a1229b2341", "scanner": "scanner-primary", "fingerprint": "e1a61ead29e17012", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8cf85f094bce9507", "level": "note", "message": {"text": "Unused endpoint: ANY /api/start"}, "properties": {"repobilityId": "b6e9161906038d7c", "scanner": "scanner-primary", "fingerprint": "8cf85f094bce9507", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-29ed6dd1feb3d89e", "level": "note", "message": {"text": "Unused endpoint: ANY /api/stop"}, "properties": {"repobilityId": "54191cde085e4f35", "scanner": "scanner-primary", "fingerprint": "29ed6dd1feb3d89e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2f861c56919f1e02", "level": "note", "message": {"text": "Unused endpoint: ANY /api/backtest"}, "properties": {"repobilityId": "4997c38750b69cc2", "scanner": "scanner-primary", "fingerprint": "2f861c56919f1e02", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5aa782149490aa2f", "level": "note", "message": {"text": "Unused endpoint: ANY /api/backtest/jobs/<job_id>"}, "properties": {"repobilityId": "1ae2e5d10824c021", "scanner": "scanner-primary", "fingerprint": "5aa782149490aa2f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-36d677a7715b9807", "level": "note", "message": {"text": "Unused endpoint: ANY /api/config"}, "properties": {"repobilityId": "17cbdffdcb51791e", "scanner": "scanner-primary", "fingerprint": "36d677a7715b9807", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-87536038ad543230", "level": "note", "message": {"text": "Unused endpoint: ANY /api/history"}, "properties": {"repobilityId": "a58e3ffa045019d8", "scanner": "scanner-primary", "fingerprint": "87536038ad543230", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d0326c1b1c092510", "level": "note", "message": {"text": "Unused endpoint: ANY /api/performance"}, "properties": {"repobilityId": "64cf5b56f28f8c0d", "scanner": "scanner-primary", "fingerprint": "d0326c1b1c092510", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bef334c0bc4b2337", "level": "note", "message": {"text": "Unused endpoint: ANY /api/chain/<instrument>"}, "properties": {"repobilityId": "d7cb3a6b99f7f5ef", "scanner": "scanner-primary", "fingerprint": "bef334c0bc4b2337", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0d66d4c02876895a", "level": "note", "message": {"text": "Unused endpoint: ANY /api/option-ltp"}, "properties": {"repobilityId": "140775ff5c146fba", "scanner": "scanner-primary", "fingerprint": "0d66d4c02876895a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4f9a9d9aa2e0fafa", "level": "note", "message": {"text": "Unused endpoint: ANY /api/test-slack"}, "properties": {"repobilityId": "f4c02b8e62e7ec67", "scanner": "scanner-primary", "fingerprint": "4f9a9d9aa2e0fafa", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7a973fb94fa92388", "level": "note", "message": {"text": "Unused endpoint: ANY /api/test-chain/<name>"}, "properties": {"repobilityId": "2ecbb08a3671946a", "scanner": "scanner-primary", "fingerprint": "7a973fb94fa92388", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-38f0949469c8c48e", "level": "note", "message": {"text": "Unused endpoint: ANY /api/metrics"}, "properties": {"repobilityId": "16e3d1dc1c252727", "scanner": "scanner-primary", "fingerprint": "38f0949469c8c48e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-43674568b2edbc10", "level": "note", "message": {"text": "Unused endpoint: ANY /api/signals/<int:sig_id>/void"}, "properties": {"repobilityId": "444729374f7eebce", "scanner": "scanner-primary", "fingerprint": "43674568b2edbc10", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5e1adb962ba0d574", "level": "note", "message": {"text": "Unused endpoint: ANY /api/killswitch"}, "properties": {"repobilityId": "2ad6202f1980f584", "scanner": "scanner-primary", "fingerprint": "5e1adb962ba0d574", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ff25b5bbf13a3d4b", "level": "note", "message": {"text": "Unused endpoint: ANY /api/strategy"}, "properties": {"repobilityId": "7f86c750032434b7", "scanner": "scanner-primary", "fingerprint": "ff25b5bbf13a3d4b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f92455eea6ee9db8", "level": "note", "message": {"text": "Unused endpoint: ANY /api/replay-premium"}, "properties": {"repobilityId": "6d23a39fce5377d7", "scanner": "scanner-primary", "fingerprint": "f92455eea6ee9db8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a4b20057d47e2fee", "level": "note", "message": {"text": "Unused endpoint: ANY /api/v2-diag"}, "properties": {"repobilityId": "ea2c651a88771220", "scanner": "scanner-primary", "fingerprint": "a4b20057d47e2fee", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b8c7fbe3b6f930a3", "level": "note", "message": {"text": "Unused endpoint: ANY /api/swing/status"}, "properties": {"repobilityId": "599eb98a568f2dd1", "scanner": "scanner-primary", "fingerprint": "b8c7fbe3b6f930a3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-76fa192f4da00992", "level": "note", "message": {"text": "Unused endpoint: ANY /api/swing/positions"}, "properties": {"repobilityId": "0f7642a9ef541975", "scanner": "scanner-primary", "fingerprint": "76fa192f4da00992", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3ca43ae918d3d9b6", "level": "note", "message": {"text": "Unused endpoint: ANY /api/swing/positions/<int:pos_id>"}, "properties": {"repobilityId": "a246f6102835b04f", "scanner": "scanner-primary", "fingerprint": "3ca43ae918d3d9b6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5d020acba7423aa5", "level": "note", "message": {"text": "Unused endpoint: ANY /api/swing/exit-analysis"}, "properties": {"repobilityId": "cb4a3f36c9834575", "scanner": "scanner-primary", "fingerprint": "5d020acba7423aa5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-002e9ef22ec0680b", "level": "note", "message": {"text": "Unused endpoint: ANY /api/swing/exit-analysis/<int:pos_id>"}, "properties": {"repobilityId": "125858ffb0be6eab", "scanner": "scanner-primary", "fingerprint": "002e9ef22ec0680b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4214d829dae604a6", "level": "note", "message": {"text": "Unused endpoint: ANY /api/swing/save-signal"}, "properties": {"repobilityId": "481271c82b3c1f00", "scanner": "scanner-primary", "fingerprint": "4214d829dae604a6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}