{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-5fb767e095c0a60e", "name": "Possibly dead Python function: extract_usage", "shortDescription": {"text": "Possibly dead Python function: extract_usage"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bead75b0f9233e05", "name": "No API endpoints detected", "shortDescription": {"text": "No API endpoints detected"}, "fullDescription": {"text": "The scanner did not find FastAPI/Flask/Express/NestJS/GraphQL/gRPC routes. If this repo exposes APIs, the framework may be unsupported."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "info", "confidence": 1.0}}, {"id": "scanner-370ee22b6f9e6592", "name": "TODO/FIXME marker in shipping code \u2014 packages/cli/src/lib/archive.ts:534", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 packages/cli/src/lib/archive.ts:534"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b30e1ca5c67cacd5", "name": "React Flow edge with `label=` but no project-wide edge-label CSS override \u2014 packages/core/test/engine.difftest.test.ts:2", "shortDescription": {"text": "React Flow edge with `label=` but no project-wide edge-label CSS override \u2014 packages/core/test/engine.difftest.test.ts:29"}, "fullDescription": {"text": "React Flow edge labels render with a white rectangle behind the text by default, which scatters bright boxes across a dark canvas. Either drop the label, or override `.react-flow__edge-textbg` and `.react-flow__edge-text` in your stylesheet.\n\nWhy: P-H in CHECKLIST.md \u2014 vendor edge labels bleed white through a dark canvas.\nRule id: fq.edge-label.no-bg"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-93bc2904400e70d5", "name": "TODO/FIXME marker in shipping code \u2014 packages/core/src/backlog/picker.ts:101", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 packages/core/src/backlog/picker.ts:101"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-893b32601c5ab4ca", "name": "Insecure pattern 'node_child_process' in packages/cli/src/runner/peer-gate.ts:54", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/runner/peer-gate.ts:54"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2bafd65d2dcf0548", "name": "Insecure pattern 'node_child_process' in packages/cli/src/runner/agent-spawn.ts:37", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/runner/agent-spawn.ts:37"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e091f63520537dcf", "name": "Insecure pattern 'node_child_process' in packages/cli/src/runner/executor.ts:114", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/runner/executor.ts:114"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a92141c9c05a8100", "name": "Insecure pattern 'node_child_process' in packages/cli/src/commands/doctor.ts:15", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/doctor.ts:15"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-94eadf0638a64261", "name": "Insecure pattern 'node_child_process' in packages/cli/src/commands/init.ts:28", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/init.ts:28"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-87abc277db985a59", "name": "Insecure pattern 'node_child_process' in packages/cli/src/commands/ci.ts:22", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/ci.ts:22"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e177df8a3db2f5ae", "name": "Insecure pattern 'node_child_process' in packages/cli/src/commands/loop-cycle-gates.ts:18", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/loop-cycle-gates.ts:18"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-93e2d66799e277ce", "name": "Insecure pattern 'node_child_process' in packages/cli/src/commands/status.ts:8", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/status.ts:8"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-909fb9900e64d838", "name": "Insecure pattern 'node_child_process' in packages/cli/src/commands/dashboard.ts:11", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/dashboard.ts:11"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c94fc13fa1048654", "name": "Insecure pattern 'node_child_process' in packages/cli/src/commands/loop-runs.ts:11", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/loop-runs.ts:11"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d21ac1e8e5c4acd9", "name": "Insecure pattern 'node_child_process' in packages/cli/src/commands/offboard.ts:17", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/offboard.ts:17"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3d34b3a4ffddebd1", "name": "Insecure pattern 'node_child_process' in packages/cli/src/commands/update.ts:27", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/update.ts:27"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fa93478b1faed421", "name": "Insecure pattern 'node_child_process' in packages/cli/src/commands/test.ts:37", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/test.ts:37"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-94b702c21910cb1d", "name": "Insecure pattern 'node_child_process' in packages/cli/src/commands/skills.ts:21", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/skills.ts:21"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c6fd86a577a6db2d", "name": "Insecure pattern 'node_child_process' in packages/cli/src/commands/loop-go.ts:18", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/loop-go.ts:18"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-41eaa0955c3be72a", "name": "Insecure pattern 'node_child_process' in packages/cli/src/commands/loop-sched.ts:43", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/loop-sched.ts:43"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6005a65c0cff13c2", "name": "Insecure pattern 'node_child_process' in packages/cli/src/commands/backlog-sync.ts:23", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/backlog-sync.ts:23"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8356a95bd64aa036", "name": "Insecure pattern 'node_child_process' in packages/cli/src/commands/lang.ts:8", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/lang.ts:8"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a61ec4e88ea30ea0", "name": "Insecure pattern 'exec_used' in packages/cli/src/commands/release.ts:119", "shortDescription": {"text": "Insecure pattern 'exec_used' in packages/cli/src/commands/release.ts:119"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cd04b5aef29d770b", "name": "Insecure pattern 'node_child_process' in packages/cli/src/commands/release.ts:32", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/release.ts:32"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0c0737c73d95fef3", "name": "Insecure pattern 'node_child_process' in packages/cli/src/commands/loop-watch.ts:27", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/loop-watch.ts:27"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-518e74a8d15526c6", "name": "Insecure pattern 'node_child_process' in packages/cli/src/commands/peer.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/peer.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dc80f0afb35efd77", "name": "Insecure pattern 'node_child_process' in packages/cli/src/commands/loop-maint.ts:18", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/loop-maint.ts:18"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-354b957e2a1d63b8", "name": "Insecure pattern 'node_child_process' in packages/cli/src/commands/attest.ts:71", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/attest.ts:71"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1e3fdc8a2218a23a", "name": "Insecure pattern 'node_child_process' in packages/cli/src/commands/setup.ts:23", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/setup.ts:23"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a9d6c237bad66159", "name": "Insecure pattern 'node_child_process' in packages/cli/src/commands/loop-run-once.ts:30", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/loop-run-once.ts:30"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1aaf1a9ce3e9e067", "name": "Insecure pattern 'node_child_process' in packages/cli/src/commands/showcase.ts:29", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/showcase.ts:29"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-37d1a224b0201998", "name": "Insecure pattern 'node_child_process' in packages/cli/src/commands/index-gen.ts:9", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/index-gen.ts:9"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2df4eb2d5e7a8f35", "name": "Insecure pattern 'node_child_process' in packages/cli/src/commands/agent-list.ts:6", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/agent-list.ts:6"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-95cb3a34abf6322c", "name": "Insecure pattern 'node_child_process' in packages/cli/src/commands/loop-pr-heal.ts:29", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/loop-pr-heal.ts:29"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4878a9204b7d74c0", "name": "Insecure pattern 'node_child_process' in packages/cli/src/lib/git-hooks.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/lib/git-hooks.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-94bfa78311e7c628", "name": "Insecure pattern 'node_child_process' in packages/cli/src/lib/consistency-audit.ts:15", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/lib/consistency-audit.ts:15"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-88d4221e954480a9", "name": "Insecure pattern 'node_child_process' in packages/cli/src/lib/story-dossier.ts:19", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/lib/story-dossier.ts:19"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b603df95fc40f1b4", "name": "Insecure pattern 'node_child_process' in packages/cli/src/lib/require-network.ts:22", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/lib/require-network.ts:22"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3b60a8159137eda2", "name": "Insecure pattern 'node_child_process' in packages/cli/src/lib/projects-registry.ts:13", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/lib/projects-registry.ts:13"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ef2ef39819e763ba", "name": "Insecure pattern 'node_child_process' in packages/core/src/delivery/infra-default.ts:11", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/core/src/delivery/infra-default.ts:11"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-89eeab8ce1d489f5", "name": "Insecure pattern 'node_child_process' in packages/infra/src/git.ts:44", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/infra/src/git.ts:44"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-241d542a73ceaafe", "name": "Insecure pattern 'node_child_process' in packages/infra/src/tmux.ts:33", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/infra/src/tmux.ts:33"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1026dacac4f85cd2", "name": "Insecure pattern 'node_child_process' in packages/infra/src/github.ts:77", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/infra/src/github.ts:77"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-646b56f1ddba019f", "name": "Insecure pattern 'node_child_process' in packages/infra/src/schedule.ts:54", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/infra/src/schedule.ts:54"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b07c20f55187f709", "name": "Insecure pattern 'node_child_process' in packages/infra/src/screenshot.ts:41", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/infra/src/screenshot.ts:41"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7d1ec8f797b2e189", "name": "Insecure pattern 'node_child_process' in packages/infra/src/evidence.ts:23", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/infra/src/evidence.ts:23"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1d350ea6493b1905", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7d2314ec27ca29c1", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8f4c232b4aa78fc9", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-77166cbd46fcd8e4", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a5037ecad3c32cc8", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/configure-pages@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3808dc79ba3f91b4", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c988d64a3ffd2f22", "name": "Very large file: packages/cli/test/attest.test.ts (1062 lines)", "shortDescription": {"text": "Very large file: packages/cli/test/attest.test.ts (1062 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c98b4bc0dde30925", "name": "Very large file: packages/cli/test/truth-console.test.ts (1133 lines)", "shortDescription": {"text": "Very large file: packages/cli/test/truth-console.test.ts (1133 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-625e581142baaa19", "name": "Very large file: packages/cli/test/runner-executor.test.ts (2025 lines)", "shortDescription": {"text": "Very large file: packages/cli/test/runner-executor.test.ts (2025 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-82b9ae1a251ac272", "name": "Very large file: packages/cli/test/dossier.test.ts (2027 lines)", "shortDescription": {"text": "Very large file: packages/cli/test/dossier.test.ts (2027 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e9fbf9e4324a9a95", "name": "Very large file: packages/cli/test/loop-go.test.ts (1500 lines)", "shortDescription": {"text": "Very large file: packages/cli/test/loop-go.test.ts (1500 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ad29f1b1dc9d3496", "name": "Very large file: packages/cli/src/runner/executor.ts (2404 lines)", "shortDescription": {"text": "Very large file: packages/cli/src/runner/executor.ts (2404 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0a0bbc7394af6dc5", "name": "Very large file: packages/cli/src/commands/dashboard.ts (2480 lines)", "shortDescription": {"text": "Very large file: packages/cli/src/commands/dashboard.ts (2480 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cc5026df7c6a7871", "name": "Very large file: packages/cli/src/commands/loop-go.ts (1652 lines)", "shortDescription": {"text": "Very large file: packages/cli/src/commands/loop-go.ts (1652 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6cbc3d5208bcae32", "name": "Very large file: packages/cli/src/lib/story-dossier.ts (2285 lines)", "shortDescription": {"text": "Very large file: packages/cli/src/lib/story-dossier.ts (2285 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-de6d62bf59121aa5", "name": "Very large file: packages/cli/src/lib/truth-console.ts (1804 lines)", "shortDescription": {"text": "Very large file: packages/cli/src/lib/truth-console.ts (1804 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5169ea371ffe5ca1", "name": "255 TODO/FIXME markers", "shortDescription": {"text": "255 TODO/FIXME markers"}, "fullDescription": {"text": "High count of TODO/FIXME/HACK markers \u2014 track them as issues so they're not forgotten."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-69d183c4d7e3c690", "name": "Node manifest has dependencies but no lockfile: packages/spec/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/spec/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8c2e3196a4ef0cdd", "name": "Node manifest has dependencies but no lockfile: packages/cli/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/cli/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-28e92806c0db3cd2", "name": "Node manifest has dependencies but no lockfile: packages/core/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/core/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-956163404ed4162c", "name": "Node manifest has dependencies but no lockfile: packages/infra/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/infra/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-65d50559d781a338", "name": "Node manifest has dependencies but no lockfile: template/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: template/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 15 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 58 placeholder/mock markers across 27 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f4ac3d4966bf095f", "name": "Agent authority lacks a verifier contract: conventions/global/GEMINI.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: conventions/global/GEMINI.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5996c10d76e3683a", "name": "Agent authority lacks a verifier contract: conventions/global/CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: conventions/global/CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-122f91b7f2906dc4", "name": "Agent authority lacks a verifier contract: .claude/settings.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6917faa073ef960a", "name": "Commented-code block (5 lines) in lib/agent_usage/kimi.py:136", "shortDescription": {"text": "Commented-code block (5 lines) in lib/agent_usage/kimi.py:136"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8ee7b0c566f21a56", "name": "Commented-code block (7 lines) in site/tweaks-panel.jsx:12", "shortDescription": {"text": "Commented-code block (7 lines) in site/tweaks-panel.jsx:12"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fc638106860c66c7", "name": "Commented-code block (5 lines) in packages/spec/src/types/events.ts:84", "shortDescription": {"text": "Commented-code block (5 lines) in packages/spec/src/types/events.ts:84"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6e9bf9fcd663149d", "name": "Commented-code block (5 lines) in packages/spec/src/i18n/catalog-v3.ts:74", "shortDescription": {"text": "Commented-code block (5 lines) in packages/spec/src/i18n/catalog-v3.ts:74"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-28d5cc58826936fb", "name": "Commented-code block (5 lines) in packages/cli/vitest.config.ts:5", "shortDescription": {"text": "Commented-code block (5 lines) in packages/cli/vitest.config.ts:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e4a34bdffe929d11", "name": "Commented-code block (5 lines) in packages/cli/test/web-cli-consistency.test.ts:114", "shortDescription": {"text": "Commented-code block (5 lines) in packages/cli/test/web-cli-consistency.test.ts:114"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f6cd1dc11a8c99b1", "name": "Commented-code block (6 lines) in packages/cli/test/attest.test.ts:171", "shortDescription": {"text": "Commented-code block (6 lines) in packages/cli/test/attest.test.ts:171"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e13688c66b331c0c", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/cli/test/backlog-sync.test.ts:2", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/cli/test/backlog-sync.test.ts:2"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-299a96c585628954", "name": "Commented-code block (5 lines) in packages/cli/test/run-cycle.integration.test.ts:591", "shortDescription": {"text": "Commented-code block (5 lines) in packages/cli/test/run-cycle.integration.test.ts:591"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b57c54ef697f4cda", "name": "Commented-code block (5 lines) in packages/cli/test/loop-sched.test.ts:203", "shortDescription": {"text": "Commented-code block (5 lines) in packages/cli/test/loop-sched.test.ts:203"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1cc710f5dec4c4e3", "name": "Commented-code block (5 lines) in packages/cli/test/pairing-gate.test.ts:512", "shortDescription": {"text": "Commented-code block (5 lines) in packages/cli/test/pairing-gate.test.ts:512"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9070df02adcdc436", "name": "Commented-code block (6 lines) in packages/cli/test/consistency.difftest.test.ts:627", "shortDescription": {"text": "Commented-code block (6 lines) in packages/cli/test/consistency.difftest.test.ts:627"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-04930264a64c5144", "name": "Legacy-named symbol `cost_list_legacy` in packages/cli/test/truth-adapter.test.ts:75", "shortDescription": {"text": "Legacy-named symbol `cost_list_legacy` in packages/cli/test/truth-adapter.test.ts:75"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7acca1f375de8653", "name": "Commented-code block (7 lines) in packages/cli/test/truth-console.test.ts:205", "shortDescription": {"text": "Commented-code block (7 lines) in packages/cli/test/truth-console.test.ts:205"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8d98ff577fbd159a", "name": "Commented-code block (7 lines) in packages/cli/test/runner-executor.test.ts:582", "shortDescription": {"text": "Commented-code block (7 lines) in packages/cli/test/runner-executor.test.ts:582"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4357a2a56c7c570f", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/cli/test/dossier-charter.test.ts:241", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/cli/test/dossier-charter.test.ts:241"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dd6b1382dd9925ec", "name": "Commented-code block (5 lines) in packages/cli/test/dossier.test.ts:120", "shortDescription": {"text": "Commented-code block (5 lines) in packages/cli/test/dossier.test.ts:120"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ecf6c9548a26a037", "name": "Commented-code block (6 lines) in packages/cli/test/goal-progress.test.ts:34", "shortDescription": {"text": "Commented-code block (6 lines) in packages/cli/test/goal-progress.test.ts:34"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-50d72b690208be12", "name": "Commented-code block (5 lines) in packages/cli/test/loop-go.test.ts:610", "shortDescription": {"text": "Commented-code block (5 lines) in packages/cli/test/loop-go.test.ts:610"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-345a4ba28e02b559", "name": "Commented-code block (5 lines) in packages/cli/test/init.difftest.test.ts:583", "shortDescription": {"text": "Commented-code block (5 lines) in packages/cli/test/init.difftest.test.ts:583"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-98a486cae10e6425", "name": "Commented-code block (5 lines) in packages/cli/test/status.difftest.test.ts:57", "shortDescription": {"text": "Commented-code block (5 lines) in packages/cli/test/status.difftest.test.ts:57"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2b85dfb6608471da", "name": "Commented-code block (5 lines) in packages/cli/src/bridge.ts:25", "shortDescription": {"text": "Commented-code block (5 lines) in packages/cli/src/bridge.ts:25"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a4ce7658b30cf5c4", "name": "Legacy-named symbol `cost_list_legacy` in packages/cli/src/render.ts:463", "shortDescription": {"text": "Legacy-named symbol `cost_list_legacy` in packages/cli/src/render.ts:463"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7952dc3331c045eb", "name": "Commented-code block (6 lines) in packages/cli/src/render.ts:504", "shortDescription": {"text": "Commented-code block (6 lines) in packages/cli/src/render.ts:504"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-987e0966cc71dfce", "name": "Commented-code block (11 lines) in packages/cli/src/runner/executor.ts:467", "shortDescription": {"text": "Commented-code block (11 lines) in packages/cli/src/runner/executor.ts:467"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e9b8302a1a7856de", "name": "Commented-code block (7 lines) in packages/cli/src/runner/pairing-gate.ts:39", "shortDescription": {"text": "Commented-code block (7 lines) in packages/cli/src/runner/pairing-gate.ts:39"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6f4875067ab4a5b8", "name": "Commented-code block (6 lines) in packages/cli/src/runner/run-cycle.ts:179", "shortDescription": {"text": "Commented-code block (6 lines) in packages/cli/src/runner/run-cycle.ts:179"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9c0b7e7825a94dfe", "name": "Commented-code block (5 lines) in packages/cli/src/runner/attest-gate.ts:286", "shortDescription": {"text": "Commented-code block (5 lines) in packages/cli/src/runner/attest-gate.ts:286"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fd8d69e2792d36e5", "name": "Commented-code block (5 lines) in packages/cli/src/commands/backlog.ts:84", "shortDescription": {"text": "Commented-code block (5 lines) in packages/cli/src/commands/backlog.ts:84"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d365e52db72ef0de", "name": "Commented-code block (5 lines) in packages/cli/src/commands/status.ts:368", "shortDescription": {"text": "Commented-code block (5 lines) in packages/cli/src/commands/status.ts:368"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2b348d4a77b9a149", "name": "Legacy-named symbol `cost_list_legacy` in packages/cli/src/commands/dashboard.ts:479", "shortDescription": {"text": "Legacy-named symbol `cost_list_legacy` in packages/cli/src/commands/dashboard.ts:479"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6de208062257b5b0", "name": "Commented-code block (6 lines) in packages/cli/src/commands/dashboard.ts:2103", "shortDescription": {"text": "Commented-code block (6 lines) in packages/cli/src/commands/dashboard.ts:2103"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c8592686cf89be5c", "name": "Commented-code block (11 lines) in packages/cli/src/commands/index.ts:102", "shortDescription": {"text": "Commented-code block (11 lines) in packages/cli/src/commands/index.ts:102"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-28b45a25fab42780", "name": "Legacy-named symbol `safe_copy` in packages/cli/src/commands/setup-shared.ts:13", "shortDescription": {"text": "Legacy-named symbol `safe_copy` in packages/cli/src/commands/setup-shared.ts:13"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6c4a7ad6ad64fee8", "name": "Commented-code block (6 lines) in packages/cli/src/commands/skills.ts:290", "shortDescription": {"text": "Commented-code block (6 lines) in packages/cli/src/commands/skills.ts:290"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fd71bc5068372444", "name": "Commented-code block (5 lines) in packages/cli/src/commands/loop-go.ts:628", "shortDescription": {"text": "Commented-code block (5 lines) in packages/cli/src/commands/loop-go.ts:628"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3f8ed25de856124d", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/cli/src/commands/backlog-sync.ts:5", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/cli/src/commands/backlog-sync.ts:5"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1e804a5d4160d5c3", "name": "Commented-code block (5 lines) in packages/cli/src/commands/release.ts:46", "shortDescription": {"text": "Commented-code block (5 lines) in packages/cli/src/commands/release.ts:46"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2e693091807ec913", "name": "Commented-code block (7 lines) in packages/cli/src/commands/attest.ts:693", "shortDescription": {"text": "Commented-code block (7 lines) in packages/cli/src/commands/attest.ts:693"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d995d87132018c77", "name": "Commented-code block (5 lines) in packages/cli/src/commands/setup.ts:349", "shortDescription": {"text": "Commented-code block (5 lines) in packages/cli/src/commands/setup.ts:349"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a32c44d1083f673e", "name": "Commented-code block (7 lines) in packages/cli/src/commands/loop-run-once.ts:430", "shortDescription": {"text": "Commented-code block (7 lines) in packages/cli/src/commands/loop-run-once.ts:430"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9bd3a1396516fb9c", "name": "Commented-code block (6 lines) in packages/cli/src/commands/index-gen.ts:305", "shortDescription": {"text": "Commented-code block (6 lines) in packages/cli/src/commands/index-gen.ts:305"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d4efb4394288c1b9", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/cli/src/commands/loop-pr-heal.ts:342", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/cli/src/commands/loop-pr-heal.ts:342"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cad3361a2b9cf6ee", "name": "Legacy-named symbol `countLegacy` in packages/cli/src/lib/dossier-index.ts:153", "shortDescription": {"text": "Legacy-named symbol `countLegacy` in packages/cli/src/lib/dossier-index.ts:153"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1e2de47195b93f29", "name": "Commented-code block (5 lines) in packages/cli/src/lib/dossier-index.ts:345", "shortDescription": {"text": "Commented-code block (5 lines) in packages/cli/src/lib/dossier-index.ts:345"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c06ad9f094397c4b", "name": "Commented-code block (6 lines) in packages/cli/src/lib/archive.ts:521", "shortDescription": {"text": "Commented-code block (6 lines) in packages/cli/src/lib/archive.ts:521"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1ecaead0d2634cd9", "name": "Commented-code block (6 lines) in packages/cli/src/lib/release-consistency.ts:21", "shortDescription": {"text": "Commented-code block (6 lines) in packages/cli/src/lib/release-consistency.ts:21"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-83d5e7f55850b764", "name": "Commented-code block (6 lines) in packages/cli/src/lib/story-dossier.ts:777", "shortDescription": {"text": "Commented-code block (6 lines) in packages/cli/src/lib/story-dossier.ts:777"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-20715ad78e927144", "name": "Commented-code block (8 lines) in packages/cli/src/lib/truth-console.ts:1336", "shortDescription": {"text": "Commented-code block (8 lines) in packages/cli/src/lib/truth-console.ts:1336"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-39147e8e4616f0d3", "name": "Commented-code block (5 lines) in packages/cli/src/lib/self-score.ts:208", "shortDescription": {"text": "Commented-code block (5 lines) in packages/cli/src/lib/self-score.ts:208"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-14907c32f651a767", "name": "Commented-code block (5 lines) in packages/cli/src/lib/cycle-ledger.ts:42", "shortDescription": {"text": "Commented-code block (5 lines) in packages/cli/src/lib/cycle-ledger.ts:42"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b49d86ce3644667a", "name": "Commented-code block (5 lines) in packages/cli/src/lib/require-network.ts:63", "shortDescription": {"text": "Commented-code block (5 lines) in packages/cli/src/lib/require-network.ts:63"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b9d4b5644fe4c007", "name": "Commented-code block (6 lines) in packages/core/test/orchestrator.difftest.test.ts:20", "shortDescription": {"text": "Commented-code block (6 lines) in packages/core/test/orchestrator.difftest.test.ts:20"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-27dee378074d413c", "name": "Commented-code block (5 lines) in packages/core/test/engine.test.ts:63", "shortDescription": {"text": "Commented-code block (5 lines) in packages/core/test/engine.test.ts:63"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cc03f2b1a4707d21", "name": "Commented-code block (5 lines) in packages/core/test/tracker.test.ts:203", "shortDescription": {"text": "Commented-code block (5 lines) in packages/core/test/tracker.test.ts:203"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b9bcf4dcff570641", "name": "Commented-code block (7 lines) in packages/core/src/policy/engine.ts:110", "shortDescription": {"text": "Commented-code block (7 lines) in packages/core/src/policy/engine.ts:110"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8f9785d231d84029", "name": "Commented-code block (8 lines) in packages/core/src/agent/pairing.ts:461", "shortDescription": {"text": "Commented-code block (8 lines) in packages/core/src/agent/pairing.ts:461"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-db4eda2afe100bae", "name": "Commented-code block (5 lines) in packages/core/src/agent/peer-review.ts:106", "shortDescription": {"text": "Commented-code block (5 lines) in packages/core/src/agent/peer-review.ts:106"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-67016bae321411d6", "name": "Commented-code block (6 lines) in packages/core/src/reconcile/engine.ts:387", "shortDescription": {"text": "Commented-code block (6 lines) in packages/core/src/reconcile/engine.ts:387"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-572f3cf038c4ee6a", "name": "Commented-code block (5 lines) in packages/core/src/backlog/picker.ts:98", "shortDescription": {"text": "Commented-code block (5 lines) in packages/core/src/backlog/picker.ts:98"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2a9ec5494dfad90c", "name": "Commented-code block (7 lines) in packages/core/src/loop/pr-loop.ts:402", "shortDescription": {"text": "Commented-code block (7 lines) in packages/core/src/loop/pr-loop.ts:402"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-369548e20b9182c4", "name": "Commented-code block (5 lines) in packages/core/src/loop/activity-signal.ts:252", "shortDescription": {"text": "Commented-code block (5 lines) in packages/core/src/loop/activity-signal.ts:252"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-07e4a91674cefea4", "name": "Commented-code block (10 lines) in packages/core/src/loop/orchestrator.ts:662", "shortDescription": {"text": "Commented-code block (10 lines) in packages/core/src/loop/orchestrator.ts:662"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cd801448336944cb", "name": "Commented-code block (7 lines) in packages/core/src/loop/recovery.ts:234", "shortDescription": {"text": "Commented-code block (7 lines) in packages/core/src/loop/recovery.ts:234"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3b8df69253194c46", "name": "Commented-code block (5 lines) in packages/infra/test/git.difftest.test.ts:72", "shortDescription": {"text": "Commented-code block (5 lines) in packages/infra/test/git.difftest.test.ts:72"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-683e5d6eac0b2d98", "name": "Commented-code block (5 lines) in packages/infra/src/config.ts:291", "shortDescription": {"text": "Commented-code block (5 lines) in packages/infra/src/config.ts:291"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b9620dbf2857f431", "name": "Commented-code block (6 lines) in packages/infra/src/git.ts:395", "shortDescription": {"text": "Commented-code block (6 lines) in packages/infra/src/git.ts:395"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-439f4f1f30d5cbe5", "name": "Commented-code block (6 lines) in packages/infra/src/github.ts:614", "shortDescription": {"text": "Commented-code block (6 lines) in packages/infra/src/github.ts:614"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2e2a4dfc9def605c", "name": "Commented-code block (6 lines) in packages/infra/src/screenshot.ts:277", "shortDescription": {"text": "Commented-code block (6 lines) in packages/infra/src/screenshot.ts:277"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b334d875f2339fa1", "name": "5 env vars used in code but missing from .env.example", "shortDescription": {"text": "5 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `LOOP_SHARED_ROOT`, `ROLL_HOME`, `ROLL_KIMI_SESSIONS_DIR`, `ROLL_LOOP_GC_RETENTION_DAYS`, `ROLL_PI_SESSIONS_DIR`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nlib/agent_usage/pi.py:usage_from_session, lib/agent_usage/kimi.py:usage_from_session\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/19155"}, "properties": {"repository": "seanyao/roll", "repoUrl": "https://github.com/seanyao/roll", "branch": "main"}, "results": [{"ruleId": "scanner-5fb767e095c0a60e", "level": "note", "message": {"text": "Possibly dead Python function: extract_usage"}, "properties": {"repobilityId": "a8654a55e1d71bd8", "scanner": "scanner-primary", "fingerprint": "5fb767e095c0a60e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lib/agent_usage/__init__.py:81"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bead75b0f9233e05", "level": "none", "message": {"text": "No API endpoints detected"}, "properties": {"repobilityId": "0f8bb852027c38f8", "scanner": "scanner-primary", "fingerprint": "bead75b0f9233e05", "layer": "api", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-370ee22b6f9e6592", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 packages/cli/src/lib/archive.ts:534"}, "properties": {"repobilityId": "158a4d0a2e06fcf3", "scanner": "scanner-primary", "fingerprint": "370ee22b6f9e6592", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-b30e1ca5c67cacd5", "level": "note", "message": {"text": "React Flow edge with `label=` but no project-wide edge-label CSS override \u2014 packages/core/test/engine.difftest.test.ts:29"}, "properties": {"repobilityId": "b3b5c334d20dd4e6", "scanner": "scanner-primary", "fingerprint": "b30e1ca5c67cacd5", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.edge-label.no-bg"]}}, {"ruleId": "scanner-93bc2904400e70d5", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 packages/core/src/backlog/picker.ts:101"}, "properties": {"repobilityId": "038038f5a152abad", "scanner": "scanner-primary", "fingerprint": "93bc2904400e70d5", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-893b32601c5ab4ca", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/runner/peer-gate.ts:54"}, "properties": {"repobilityId": "95c3ab246eda943b", "scanner": "scanner-primary", "fingerprint": "893b32601c5ab4ca", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/runner/peer-gate.ts"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-2bafd65d2dcf0548", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/runner/agent-spawn.ts:37"}, "properties": {"repobilityId": "d7c15ce90d5b4a3b", "scanner": "scanner-primary", "fingerprint": "2bafd65d2dcf0548", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/runner/agent-spawn.ts"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-e091f63520537dcf", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/runner/executor.ts:114"}, "properties": {"repobilityId": "8f60d4ab19d9ba61", "scanner": "scanner-primary", "fingerprint": "e091f63520537dcf", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/runner/executor.ts"}, "region": {"startLine": 114}}}]}, {"ruleId": "scanner-a92141c9c05a8100", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/doctor.ts:15"}, "properties": {"repobilityId": "e14436eb210e0ce5", "scanner": "scanner-primary", "fingerprint": "a92141c9c05a8100", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/commands/doctor.ts"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-94eadf0638a64261", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/init.ts:28"}, "properties": {"repobilityId": "feaf20ad554b0a42", "scanner": "scanner-primary", "fingerprint": "94eadf0638a64261", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/commands/init.ts"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-87abc277db985a59", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/ci.ts:22"}, "properties": {"repobilityId": "d3f46d6835f2dc84", "scanner": "scanner-primary", "fingerprint": "87abc277db985a59", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/commands/ci.ts"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-e177df8a3db2f5ae", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/loop-cycle-gates.ts:18"}, "properties": {"repobilityId": "2225902aa1ec041d", "scanner": "scanner-primary", "fingerprint": "e177df8a3db2f5ae", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/commands/loop-cycle-gates.ts"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-93e2d66799e277ce", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/status.ts:8"}, "properties": {"repobilityId": "12b20498dcb5a51b", "scanner": "scanner-primary", "fingerprint": "93e2d66799e277ce", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/commands/status.ts"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-909fb9900e64d838", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/dashboard.ts:11"}, "properties": {"repobilityId": "d6ced982b79cda98", "scanner": "scanner-primary", "fingerprint": "909fb9900e64d838", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/commands/dashboard.ts"}, "region": {"startLine": 11}}}]}, {"ruleId": "scanner-c94fc13fa1048654", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/loop-runs.ts:11"}, "properties": {"repobilityId": "13fe2693d3413fb4", "scanner": "scanner-primary", "fingerprint": "c94fc13fa1048654", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/commands/loop-runs.ts"}, "region": {"startLine": 11}}}]}, {"ruleId": "scanner-d21ac1e8e5c4acd9", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/offboard.ts:17"}, "properties": {"repobilityId": "8eea62d00a83cec2", "scanner": "scanner-primary", "fingerprint": "d21ac1e8e5c4acd9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/commands/offboard.ts"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-3d34b3a4ffddebd1", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/update.ts:27"}, "properties": {"repobilityId": "1fb5b446f8bb35f3", "scanner": "scanner-primary", "fingerprint": "3d34b3a4ffddebd1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/commands/update.ts"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-fa93478b1faed421", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/test.ts:37"}, "properties": {"repobilityId": "d6f519d45f57e1de", "scanner": "scanner-primary", "fingerprint": "fa93478b1faed421", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/commands/test.ts"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-94b702c21910cb1d", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/skills.ts:21"}, "properties": {"repobilityId": "5624b075df3260e4", "scanner": "scanner-primary", "fingerprint": "94b702c21910cb1d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/commands/skills.ts"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-c6fd86a577a6db2d", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/loop-go.ts:18"}, "properties": {"repobilityId": "039ae659bc076c83", "scanner": "scanner-primary", "fingerprint": "c6fd86a577a6db2d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/commands/loop-go.ts"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-41eaa0955c3be72a", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/loop-sched.ts:43"}, "properties": {"repobilityId": "f9a7d0ea516d9ca7", "scanner": "scanner-primary", "fingerprint": "41eaa0955c3be72a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/commands/loop-sched.ts"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-6005a65c0cff13c2", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/backlog-sync.ts:23"}, "properties": {"repobilityId": "9797f5dceabd8ab8", "scanner": "scanner-primary", "fingerprint": "6005a65c0cff13c2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/commands/backlog-sync.ts"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-8356a95bd64aa036", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/lang.ts:8"}, "properties": {"repobilityId": "dd768a3fa4eb3bd2", "scanner": "scanner-primary", "fingerprint": "8356a95bd64aa036", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/commands/lang.ts"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-a61ec4e88ea30ea0", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in packages/cli/src/commands/release.ts:119"}, "properties": {"repobilityId": "be87b98b08dcfe52", "scanner": "scanner-primary", "fingerprint": "a61ec4e88ea30ea0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/commands/release.ts"}, "region": {"startLine": 119}}}]}, {"ruleId": "scanner-cd04b5aef29d770b", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/release.ts:32"}, "properties": {"repobilityId": "8be62ad1ba683333", "scanner": "scanner-primary", "fingerprint": "cd04b5aef29d770b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/commands/release.ts"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-0c0737c73d95fef3", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/loop-watch.ts:27"}, "properties": {"repobilityId": "753c26471e948334", "scanner": "scanner-primary", "fingerprint": "0c0737c73d95fef3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/commands/loop-watch.ts"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-518e74a8d15526c6", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/peer.ts:1"}, "properties": {"repobilityId": "485b3bdf2aff56f6", "scanner": "scanner-primary", "fingerprint": "518e74a8d15526c6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/commands/peer.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dc80f0afb35efd77", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/loop-maint.ts:18"}, "properties": {"repobilityId": "6b6d1ef4029f316a", "scanner": "scanner-primary", "fingerprint": "dc80f0afb35efd77", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/commands/loop-maint.ts"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-354b957e2a1d63b8", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/attest.ts:71"}, "properties": {"repobilityId": "0aa9cc1cb36af2f2", "scanner": "scanner-primary", "fingerprint": "354b957e2a1d63b8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/commands/attest.ts"}, "region": {"startLine": 71}}}]}, {"ruleId": "scanner-1e3fdc8a2218a23a", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/setup.ts:23"}, "properties": {"repobilityId": "ade8fa7dfdad1b66", "scanner": "scanner-primary", "fingerprint": "1e3fdc8a2218a23a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/commands/setup.ts"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-a9d6c237bad66159", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/loop-run-once.ts:30"}, "properties": {"repobilityId": "b7ee4992781025d7", "scanner": "scanner-primary", "fingerprint": "a9d6c237bad66159", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/commands/loop-run-once.ts"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-1aaf1a9ce3e9e067", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/showcase.ts:29"}, "properties": {"repobilityId": "777d4f1ceaa361e2", "scanner": "scanner-primary", "fingerprint": "1aaf1a9ce3e9e067", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/commands/showcase.ts"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-37d1a224b0201998", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/index-gen.ts:9"}, "properties": {"repobilityId": "f699c486ebd93daf", "scanner": "scanner-primary", "fingerprint": "37d1a224b0201998", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/commands/index-gen.ts"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-2df4eb2d5e7a8f35", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/agent-list.ts:6"}, "properties": {"repobilityId": "a448940b23fe4326", "scanner": "scanner-primary", "fingerprint": "2df4eb2d5e7a8f35", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/commands/agent-list.ts"}, "region": {"startLine": 6}}}]}, {"ruleId": "scanner-95cb3a34abf6322c", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/commands/loop-pr-heal.ts:29"}, "properties": {"repobilityId": "e91e7a93a8901d54", "scanner": "scanner-primary", "fingerprint": "95cb3a34abf6322c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/commands/loop-pr-heal.ts"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-4878a9204b7d74c0", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/lib/git-hooks.ts:1"}, "properties": {"repobilityId": "ce3faceae708f6b5", "scanner": "scanner-primary", "fingerprint": "4878a9204b7d74c0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/lib/git-hooks.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-94bfa78311e7c628", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/lib/consistency-audit.ts:15"}, "properties": {"repobilityId": "2b8356061a3ab3c4", "scanner": "scanner-primary", "fingerprint": "94bfa78311e7c628", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/lib/consistency-audit.ts"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-88d4221e954480a9", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/lib/story-dossier.ts:19"}, "properties": {"repobilityId": "cc8aacc56be75a8b", "scanner": "scanner-primary", "fingerprint": "88d4221e954480a9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/lib/story-dossier.ts"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-b603df95fc40f1b4", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/lib/require-network.ts:22"}, "properties": {"repobilityId": "43a5c0b669e1ee6a", "scanner": "scanner-primary", "fingerprint": "b603df95fc40f1b4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/lib/require-network.ts"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-3b60a8159137eda2", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/cli/src/lib/projects-registry.ts:13"}, "properties": {"repobilityId": "fbcfe1299a91efa5", "scanner": "scanner-primary", "fingerprint": "3b60a8159137eda2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/src/lib/projects-registry.ts"}, "region": {"startLine": 13}}}]}, {"ruleId": "scanner-ef2ef39819e763ba", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/core/src/delivery/infra-default.ts:11"}, "properties": {"repobilityId": "e9a0a39dd36df77b", "scanner": "scanner-primary", "fingerprint": "ef2ef39819e763ba", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/core/src/delivery/infra-default.ts"}, "region": {"startLine": 11}}}]}, {"ruleId": "scanner-89eeab8ce1d489f5", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/infra/src/git.ts:44"}, "properties": {"repobilityId": "072f7d9c4423a87c", "scanner": "scanner-primary", "fingerprint": "89eeab8ce1d489f5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/infra/src/git.ts"}, "region": {"startLine": 44}}}]}, {"ruleId": "scanner-241d542a73ceaafe", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/infra/src/tmux.ts:33"}, "properties": {"repobilityId": "89ee6b8f98567cfa", "scanner": "scanner-primary", "fingerprint": "241d542a73ceaafe", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/infra/src/tmux.ts"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-1026dacac4f85cd2", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/infra/src/github.ts:77"}, "properties": {"repobilityId": "6c7ea97e007ba4cc", "scanner": "scanner-primary", "fingerprint": "1026dacac4f85cd2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/infra/src/github.ts"}, "region": {"startLine": 77}}}]}, {"ruleId": "scanner-646b56f1ddba019f", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/infra/src/schedule.ts:54"}, "properties": {"repobilityId": "4a7fea5e17cc3e36", "scanner": "scanner-primary", "fingerprint": "646b56f1ddba019f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/infra/src/schedule.ts"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-b07c20f55187f709", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/infra/src/screenshot.ts:41"}, "properties": {"repobilityId": "2db89574af36c99c", "scanner": "scanner-primary", "fingerprint": "b07c20f55187f709", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/infra/src/screenshot.ts"}, "region": {"startLine": 41}}}]}, {"ruleId": "scanner-7d1ec8f797b2e189", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/infra/src/evidence.ts:23"}, "properties": {"repobilityId": "e939f35047f18c62", "scanner": "scanner-primary", "fingerprint": "7d1ec8f797b2e189", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/infra/src/evidence.ts"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-1d350ea6493b1905", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "425bf3a715740c40", "scanner": "scanner-primary", "fingerprint": "1d350ea6493b1905", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "template/.github/workflows/ci.yml"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-7d2314ec27ca29c1", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4bc90f312d599654", "scanner": "scanner-primary", "fingerprint": "7d2314ec27ca29c1", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "template/.github/workflows/sentinel.yml"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-8f4c232b4aa78fc9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f2aa8458f6ec87a2", "scanner": "scanner-primary", "fingerprint": "8f4c232b4aa78fc9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude-code-review.yml"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-8f4c232b4aa78fc9", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7572d8d133564421", "scanner": "scanner-primary", "fingerprint": "8f4c232b4aa78fc9", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude-code-review.yml"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-77166cbd46fcd8e4", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "50f3b563ffac10e9", "scanner": "scanner-primary", "fingerprint": "77166cbd46fcd8e4", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude-code-review.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a5037ecad3c32cc8", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "dc5221153a1144e7", "scanner": "scanner-primary", "fingerprint": "a5037ecad3c32cc8", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-site.yml"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-a5037ecad3c32cc8", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "dcfe9d7677756547", "scanner": "scanner-primary", "fingerprint": "a5037ecad3c32cc8", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-site.yml"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-a5037ecad3c32cc8", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4d31bd7d8435fedc", "scanner": "scanner-primary", "fingerprint": "a5037ecad3c32cc8", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-site.yml"}, "region": {"startLine": 38}}}]}, {"ruleId": "scanner-3808dc79ba3f91b4", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "e5c492438c53b765", "scanner": "scanner-primary", "fingerprint": "3808dc79ba3f91b4", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-site.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c988d64a3ffd2f22", "level": "note", "message": {"text": "Very large file: packages/cli/test/attest.test.ts (1062 lines)"}, "properties": {"repobilityId": "afb3f11b65d19df5", "scanner": "scanner-primary", "fingerprint": "c988d64a3ffd2f22", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-c98b4bc0dde30925", "level": "note", "message": {"text": "Very large file: packages/cli/test/truth-console.test.ts (1133 lines)"}, "properties": {"repobilityId": "e1a9a9de26c4ccf3", "scanner": "scanner-primary", "fingerprint": "c98b4bc0dde30925", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-625e581142baaa19", "level": "note", "message": {"text": "Very large file: packages/cli/test/runner-executor.test.ts (2025 lines)"}, "properties": {"repobilityId": "07732ccdc8587c0d", "scanner": "scanner-primary", "fingerprint": "625e581142baaa19", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-82b9ae1a251ac272", "level": "note", "message": {"text": "Very large file: packages/cli/test/dossier.test.ts (2027 lines)"}, "properties": {"repobilityId": "1e660288f56edc71", "scanner": "scanner-primary", "fingerprint": "82b9ae1a251ac272", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e9fbf9e4324a9a95", "level": "note", "message": {"text": "Very large file: packages/cli/test/loop-go.test.ts (1500 lines)"}, "properties": {"repobilityId": "fa625b4dccccaa24", "scanner": "scanner-primary", "fingerprint": "e9fbf9e4324a9a95", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ad29f1b1dc9d3496", "level": "note", "message": {"text": "Very large file: packages/cli/src/runner/executor.ts (2404 lines)"}, "properties": {"repobilityId": "688fab266ea02bc9", "scanner": "scanner-primary", "fingerprint": "ad29f1b1dc9d3496", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-0a0bbc7394af6dc5", "level": "note", "message": {"text": "Very large file: packages/cli/src/commands/dashboard.ts (2480 lines)"}, "properties": {"repobilityId": "45d8d01601bf894e", "scanner": "scanner-primary", "fingerprint": "0a0bbc7394af6dc5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-cc5026df7c6a7871", "level": "note", "message": {"text": "Very large file: packages/cli/src/commands/loop-go.ts (1652 lines)"}, "properties": {"repobilityId": "8c0092ec162a27f8", "scanner": "scanner-primary", "fingerprint": "cc5026df7c6a7871", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6cbc3d5208bcae32", "level": "note", "message": {"text": "Very large file: packages/cli/src/lib/story-dossier.ts (2285 lines)"}, "properties": {"repobilityId": "3de15849fc16f450", "scanner": "scanner-primary", "fingerprint": "6cbc3d5208bcae32", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-de6d62bf59121aa5", "level": "note", "message": {"text": "Very large file: packages/cli/src/lib/truth-console.ts (1804 lines)"}, "properties": {"repobilityId": "44055fe071f15c6d", "scanner": "scanner-primary", "fingerprint": "de6d62bf59121aa5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5169ea371ffe5ca1", "level": "note", "message": {"text": "255 TODO/FIXME markers"}, "properties": {"repobilityId": "4b38c118003e07d2", "scanner": "scanner-primary", "fingerprint": "5169ea371ffe5ca1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["maintenance"]}}, {"ruleId": "scanner-69d183c4d7e3c690", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/spec/package.json"}, "properties": {"repobilityId": "98a97cdc4b9b0a4e", "scanner": "scanner-primary", "fingerprint": "69d183c4d7e3c690", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/spec/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8c2e3196a4ef0cdd", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/cli/package.json"}, "properties": {"repobilityId": "2faf23490612d7a6", "scanner": "scanner-primary", "fingerprint": "8c2e3196a4ef0cdd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-28e92806c0db3cd2", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/core/package.json"}, "properties": {"repobilityId": "8640e46be7e3f9b2", "scanner": "scanner-primary", "fingerprint": "28e92806c0db3cd2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/core/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-956163404ed4162c", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/infra/package.json"}, "properties": {"repobilityId": "a489ae1bd4c46bea", "scanner": "scanner-primary", "fingerprint": "956163404ed4162c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/infra/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-65d50559d781a338", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: template/package.json"}, "properties": {"repobilityId": "cc58069ca5380079", "scanner": "scanner-primary", "fingerprint": "65d50559d781a338", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "template/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "37e27d443ebbd3f9", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "0bfacfa635f16670", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "4dcbc1f23618b5c4", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "701ad501dce54c12", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "b15a87cbd2918ed5", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "362984ec25a1a543", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-f4ac3d4966bf095f", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: conventions/global/GEMINI.md"}, "properties": {"repobilityId": "164c4a763a493c58", "scanner": "scanner-primary", "fingerprint": "f4ac3d4966bf095f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "gemini_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "conventions/global/GEMINI.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5996c10d76e3683a", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: conventions/global/CLAUDE.md"}, "properties": {"repobilityId": "18978baf5e6a7ab8", "scanner": "scanner-primary", "fingerprint": "5996c10d76e3683a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "conventions/global/CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-122f91b7f2906dc4", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "properties": {"repobilityId": "a2967269048b6a9d", "scanner": "scanner-primary", "fingerprint": "122f91b7f2906dc4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/settings.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6917faa073ef960a", "level": "none", "message": {"text": "Commented-code block (5 lines) in lib/agent_usage/kimi.py:136"}, "properties": {"repobilityId": "1df9f5819f7f7e24", "scanner": "scanner-primary", "fingerprint": "6917faa073ef960a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8ee7b0c566f21a56", "level": "none", "message": {"text": "Commented-code block (7 lines) in site/tweaks-panel.jsx:12"}, "properties": {"repobilityId": "7f70b4db508c7c67", "scanner": "scanner-primary", "fingerprint": "8ee7b0c566f21a56", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fc638106860c66c7", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/spec/src/types/events.ts:84"}, "properties": {"repobilityId": "48a1beea0d7d6fcf", "scanner": "scanner-primary", "fingerprint": "fc638106860c66c7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6e9bf9fcd663149d", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/spec/src/i18n/catalog-v3.ts:74"}, "properties": {"repobilityId": "1a4639a2f66130c0", "scanner": "scanner-primary", "fingerprint": "6e9bf9fcd663149d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-28d5cc58826936fb", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/cli/vitest.config.ts:5"}, "properties": {"repobilityId": "f0ce7ba6ab069bf6", "scanner": "scanner-primary", "fingerprint": "28d5cc58826936fb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e4a34bdffe929d11", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/cli/test/web-cli-consistency.test.ts:114"}, "properties": {"repobilityId": "f311be99762b3a34", "scanner": "scanner-primary", "fingerprint": "e4a34bdffe929d11", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f6cd1dc11a8c99b1", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/cli/test/attest.test.ts:171"}, "properties": {"repobilityId": "9057e450ee730433", "scanner": "scanner-primary", "fingerprint": "f6cd1dc11a8c99b1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e13688c66b331c0c", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/cli/test/backlog-sync.test.ts:2"}, "properties": {"repobilityId": "1b6e9f813e86c862", "scanner": "scanner-primary", "fingerprint": "e13688c66b331c0c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-299a96c585628954", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/cli/test/run-cycle.integration.test.ts:591"}, "properties": {"repobilityId": "8108d9519d7cc2fb", "scanner": "scanner-primary", "fingerprint": "299a96c585628954", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b57c54ef697f4cda", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/cli/test/loop-sched.test.ts:203"}, "properties": {"repobilityId": "029e4f87ebaa1927", "scanner": "scanner-primary", "fingerprint": "b57c54ef697f4cda", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1cc710f5dec4c4e3", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/cli/test/pairing-gate.test.ts:512"}, "properties": {"repobilityId": "2716316fbe056847", "scanner": "scanner-primary", "fingerprint": "1cc710f5dec4c4e3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9070df02adcdc436", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/cli/test/consistency.difftest.test.ts:627"}, "properties": {"repobilityId": "e53cd306c9feace2", "scanner": "scanner-primary", "fingerprint": "9070df02adcdc436", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-04930264a64c5144", "level": "note", "message": {"text": "Legacy-named symbol `cost_list_legacy` in packages/cli/test/truth-adapter.test.ts:75"}, "properties": {"repobilityId": "e036088f31dfda39", "scanner": "scanner-primary", "fingerprint": "04930264a64c5144", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-7acca1f375de8653", "level": "none", "message": {"text": "Commented-code block (7 lines) in packages/cli/test/truth-console.test.ts:205"}, "properties": {"repobilityId": "c13baf543cbb350a", "scanner": "scanner-primary", "fingerprint": "7acca1f375de8653", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8d98ff577fbd159a", "level": "none", "message": {"text": "Commented-code block (7 lines) in packages/cli/test/runner-executor.test.ts:582"}, "properties": {"repobilityId": "4f707ddda0f5bd9d", "scanner": "scanner-primary", "fingerprint": "8d98ff577fbd159a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4357a2a56c7c570f", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/cli/test/dossier-charter.test.ts:241"}, "properties": {"repobilityId": "4ea72396f303faaa", "scanner": "scanner-primary", "fingerprint": "4357a2a56c7c570f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-dd6b1382dd9925ec", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/cli/test/dossier.test.ts:120"}, "properties": {"repobilityId": "40ca377d83225ebd", "scanner": "scanner-primary", "fingerprint": "dd6b1382dd9925ec", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ecf6c9548a26a037", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/cli/test/goal-progress.test.ts:34"}, "properties": {"repobilityId": "65a01f2efbbb655a", "scanner": "scanner-primary", "fingerprint": "ecf6c9548a26a037", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-50d72b690208be12", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/cli/test/loop-go.test.ts:610"}, "properties": {"repobilityId": "83008099469c9495", "scanner": "scanner-primary", "fingerprint": "50d72b690208be12", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-345a4ba28e02b559", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/cli/test/init.difftest.test.ts:583"}, "properties": {"repobilityId": "d658ecaeb4ca9cf4", "scanner": "scanner-primary", "fingerprint": "345a4ba28e02b559", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-98a486cae10e6425", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/cli/test/status.difftest.test.ts:57"}, "properties": {"repobilityId": "ac49bf3971cb2daf", "scanner": "scanner-primary", "fingerprint": "98a486cae10e6425", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2b85dfb6608471da", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/cli/src/bridge.ts:25"}, "properties": {"repobilityId": "27092d248fa1e04d", "scanner": "scanner-primary", "fingerprint": "2b85dfb6608471da", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a4ce7658b30cf5c4", "level": "note", "message": {"text": "Legacy-named symbol `cost_list_legacy` in packages/cli/src/render.ts:463"}, "properties": {"repobilityId": "afc363871ba843e0", "scanner": "scanner-primary", "fingerprint": "a4ce7658b30cf5c4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-7952dc3331c045eb", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/cli/src/render.ts:504"}, "properties": {"repobilityId": "14331ce2b35a42ba", "scanner": "scanner-primary", "fingerprint": "7952dc3331c045eb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-987e0966cc71dfce", "level": "none", "message": {"text": "Commented-code block (11 lines) in packages/cli/src/runner/executor.ts:467"}, "properties": {"repobilityId": "517f1a26d15c33e2", "scanner": "scanner-primary", "fingerprint": "987e0966cc71dfce", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e9b8302a1a7856de", "level": "none", "message": {"text": "Commented-code block (7 lines) in packages/cli/src/runner/pairing-gate.ts:39"}, "properties": {"repobilityId": "8f3e13fe1205fc42", "scanner": "scanner-primary", "fingerprint": "e9b8302a1a7856de", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6f4875067ab4a5b8", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/cli/src/runner/run-cycle.ts:179"}, "properties": {"repobilityId": "33486550ac9f619c", "scanner": "scanner-primary", "fingerprint": "6f4875067ab4a5b8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9c0b7e7825a94dfe", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/cli/src/runner/attest-gate.ts:286"}, "properties": {"repobilityId": "2157ffd7321e123d", "scanner": "scanner-primary", "fingerprint": "9c0b7e7825a94dfe", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fd8d69e2792d36e5", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/cli/src/commands/backlog.ts:84"}, "properties": {"repobilityId": "c1619d06cec80465", "scanner": "scanner-primary", "fingerprint": "fd8d69e2792d36e5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d365e52db72ef0de", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/cli/src/commands/status.ts:368"}, "properties": {"repobilityId": "111b81ba7f1e5cd8", "scanner": "scanner-primary", "fingerprint": "d365e52db72ef0de", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2b348d4a77b9a149", "level": "note", "message": {"text": "Legacy-named symbol `cost_list_legacy` in packages/cli/src/commands/dashboard.ts:479"}, "properties": {"repobilityId": "c10249c8b726cf4a", "scanner": "scanner-primary", "fingerprint": "2b348d4a77b9a149", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-6de208062257b5b0", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/cli/src/commands/dashboard.ts:2103"}, "properties": {"repobilityId": "a9bc8e4dbc2733f4", "scanner": "scanner-primary", "fingerprint": "6de208062257b5b0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c8592686cf89be5c", "level": "none", "message": {"text": "Commented-code block (11 lines) in packages/cli/src/commands/index.ts:102"}, "properties": {"repobilityId": "6e083471b2648a09", "scanner": "scanner-primary", "fingerprint": "c8592686cf89be5c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-28b45a25fab42780", "level": "note", "message": {"text": "Legacy-named symbol `safe_copy` in packages/cli/src/commands/setup-shared.ts:13"}, "properties": {"repobilityId": "c3cf52f5aa7f5f55", "scanner": "scanner-primary", "fingerprint": "28b45a25fab42780", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-6c4a7ad6ad64fee8", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/cli/src/commands/skills.ts:290"}, "properties": {"repobilityId": "005d58fd8cf5a461", "scanner": "scanner-primary", "fingerprint": "6c4a7ad6ad64fee8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fd71bc5068372444", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/cli/src/commands/loop-go.ts:628"}, "properties": {"repobilityId": "278ba4ec60384353", "scanner": "scanner-primary", "fingerprint": "fd71bc5068372444", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3f8ed25de856124d", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/cli/src/commands/backlog-sync.ts:5"}, "properties": {"repobilityId": "c5ae319c0ad97f30", "scanner": "scanner-primary", "fingerprint": "3f8ed25de856124d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-1e804a5d4160d5c3", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/cli/src/commands/release.ts:46"}, "properties": {"repobilityId": "1259b05aa9e086d1", "scanner": "scanner-primary", "fingerprint": "1e804a5d4160d5c3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2e693091807ec913", "level": "none", "message": {"text": "Commented-code block (7 lines) in packages/cli/src/commands/attest.ts:693"}, "properties": {"repobilityId": "d4b8b1148c7bc488", "scanner": "scanner-primary", "fingerprint": "2e693091807ec913", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d995d87132018c77", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/cli/src/commands/setup.ts:349"}, "properties": {"repobilityId": "aac60c295e4be0e3", "scanner": "scanner-primary", "fingerprint": "d995d87132018c77", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a32c44d1083f673e", "level": "none", "message": {"text": "Commented-code block (7 lines) in packages/cli/src/commands/loop-run-once.ts:430"}, "properties": {"repobilityId": "eb4142026abe0a6e", "scanner": "scanner-primary", "fingerprint": "a32c44d1083f673e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9bd3a1396516fb9c", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/cli/src/commands/index-gen.ts:305"}, "properties": {"repobilityId": "d0c1dbe4c4900301", "scanner": "scanner-primary", "fingerprint": "9bd3a1396516fb9c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d4efb4394288c1b9", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/cli/src/commands/loop-pr-heal.ts:342"}, "properties": {"repobilityId": "b57acd6a9900e3bd", "scanner": "scanner-primary", "fingerprint": "d4efb4394288c1b9", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-cad3361a2b9cf6ee", "level": "note", "message": {"text": "Legacy-named symbol `countLegacy` in packages/cli/src/lib/dossier-index.ts:153"}, "properties": {"repobilityId": "0de523d2f9129a07", "scanner": "scanner-primary", "fingerprint": "cad3361a2b9cf6ee", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-1e2de47195b93f29", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/cli/src/lib/dossier-index.ts:345"}, "properties": {"repobilityId": "c0c8ba76606447e1", "scanner": "scanner-primary", "fingerprint": "1e2de47195b93f29", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c06ad9f094397c4b", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/cli/src/lib/archive.ts:521"}, "properties": {"repobilityId": "aa93b54ae4c0824c", "scanner": "scanner-primary", "fingerprint": "c06ad9f094397c4b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1ecaead0d2634cd9", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/cli/src/lib/release-consistency.ts:21"}, "properties": {"repobilityId": "75a6164b351b4348", "scanner": "scanner-primary", "fingerprint": "1ecaead0d2634cd9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-83d5e7f55850b764", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/cli/src/lib/story-dossier.ts:777"}, "properties": {"repobilityId": "c7ce575a3cd86b5d", "scanner": "scanner-primary", "fingerprint": "83d5e7f55850b764", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-20715ad78e927144", "level": "none", "message": {"text": "Commented-code block (8 lines) in packages/cli/src/lib/truth-console.ts:1336"}, "properties": {"repobilityId": "704753419b99dbde", "scanner": "scanner-primary", "fingerprint": "20715ad78e927144", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-39147e8e4616f0d3", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/cli/src/lib/self-score.ts:208"}, "properties": {"repobilityId": "c273ddd41973065a", "scanner": "scanner-primary", "fingerprint": "39147e8e4616f0d3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-14907c32f651a767", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/cli/src/lib/cycle-ledger.ts:42"}, "properties": {"repobilityId": "340baf93d72c96bf", "scanner": "scanner-primary", "fingerprint": "14907c32f651a767", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b49d86ce3644667a", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/cli/src/lib/require-network.ts:63"}, "properties": {"repobilityId": "4547fa9cc57bd749", "scanner": "scanner-primary", "fingerprint": "b49d86ce3644667a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b9d4b5644fe4c007", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/core/test/orchestrator.difftest.test.ts:20"}, "properties": {"repobilityId": "95e8ae908831e262", "scanner": "scanner-primary", "fingerprint": "b9d4b5644fe4c007", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-27dee378074d413c", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/core/test/engine.test.ts:63"}, "properties": {"repobilityId": "4f31fdc87c562d29", "scanner": "scanner-primary", "fingerprint": "27dee378074d413c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cc03f2b1a4707d21", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/core/test/tracker.test.ts:203"}, "properties": {"repobilityId": "2015fa1f96b47ed8", "scanner": "scanner-primary", "fingerprint": "cc03f2b1a4707d21", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b9bcf4dcff570641", "level": "none", "message": {"text": "Commented-code block (7 lines) in packages/core/src/policy/engine.ts:110"}, "properties": {"repobilityId": "ff73246a7411e2c0", "scanner": "scanner-primary", "fingerprint": "b9bcf4dcff570641", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8f9785d231d84029", "level": "none", "message": {"text": "Commented-code block (8 lines) in packages/core/src/agent/pairing.ts:461"}, "properties": {"repobilityId": "219275665837aecc", "scanner": "scanner-primary", "fingerprint": "8f9785d231d84029", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-db4eda2afe100bae", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/core/src/agent/peer-review.ts:106"}, "properties": {"repobilityId": "9a1f2ef749cfa256", "scanner": "scanner-primary", "fingerprint": "db4eda2afe100bae", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-67016bae321411d6", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/core/src/reconcile/engine.ts:387"}, "properties": {"repobilityId": "dd85296339359960", "scanner": "scanner-primary", "fingerprint": "67016bae321411d6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-572f3cf038c4ee6a", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/core/src/backlog/picker.ts:98"}, "properties": {"repobilityId": "753ed929797d6052", "scanner": "scanner-primary", "fingerprint": "572f3cf038c4ee6a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2a9ec5494dfad90c", "level": "none", "message": {"text": "Commented-code block (7 lines) in packages/core/src/loop/pr-loop.ts:402"}, "properties": {"repobilityId": "8a807ab8ea95debb", "scanner": "scanner-primary", "fingerprint": "2a9ec5494dfad90c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-369548e20b9182c4", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/core/src/loop/activity-signal.ts:252"}, "properties": {"repobilityId": "330ad85e0f646189", "scanner": "scanner-primary", "fingerprint": "369548e20b9182c4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-07e4a91674cefea4", "level": "none", "message": {"text": "Commented-code block (10 lines) in packages/core/src/loop/orchestrator.ts:662"}, "properties": {"repobilityId": "15f588459691d479", "scanner": "scanner-primary", "fingerprint": "07e4a91674cefea4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cd801448336944cb", "level": "none", "message": {"text": "Commented-code block (7 lines) in packages/core/src/loop/recovery.ts:234"}, "properties": {"repobilityId": "8de3c71ec6e5a5d3", "scanner": "scanner-primary", "fingerprint": "cd801448336944cb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3b8df69253194c46", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/infra/test/git.difftest.test.ts:72"}, "properties": {"repobilityId": "fc111d1d805945db", "scanner": "scanner-primary", "fingerprint": "3b8df69253194c46", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-683e5d6eac0b2d98", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/infra/src/config.ts:291"}, "properties": {"repobilityId": "74f0b11d7debbf85", "scanner": "scanner-primary", "fingerprint": "683e5d6eac0b2d98", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b9620dbf2857f431", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/infra/src/git.ts:395"}, "properties": {"repobilityId": "162b91ec9f406a5e", "scanner": "scanner-primary", "fingerprint": "b9620dbf2857f431", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-439f4f1f30d5cbe5", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/infra/src/github.ts:614"}, "properties": {"repobilityId": "eadb133d55cdc8dd", "scanner": "scanner-primary", "fingerprint": "439f4f1f30d5cbe5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2e2a4dfc9def605c", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/infra/src/screenshot.ts:277"}, "properties": {"repobilityId": "b012e8706dde9d80", "scanner": "scanner-primary", "fingerprint": "2e2a4dfc9def605c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b334d875f2339fa1", "level": "note", "message": {"text": "5 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "faa38682016f5d53", "scanner": "scanner-primary", "fingerprint": "b334d875f2339fa1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "9813553f9a61c347", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}]}]}