{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-639fc8d623d078fd", "name": "Possibly dead Python function: handle_starttag", "shortDescription": {"text": "Possibly dead Python function: handle_starttag"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-840771db4b9f2516", "name": "Possibly dead Python function: handle_endtag", "shortDescription": {"text": "Possibly dead Python function: handle_endtag"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c11dd58c045f2b2a", "name": "Possibly dead Python function: handle_data", "shortDescription": {"text": "Possibly dead Python function: handle_data"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ef17dd4b3c6516da", "name": "Agent authority lacks a verifier contract: skills/design-eval/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/design-eval/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0db4a3b2c59b8792", "name": "Agent authority lacks a verifier contract: skills/explore/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/explore/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4438101b547e5e7c", "name": "Agent authority lacks a verifier contract: skills/savings/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/savings/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7193a72f6d512095", "name": "Agent authority lacks a verifier contract: skills/evaluate/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/evaluate/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8fea4e3e51172133", "name": "Legacy-named symbol `model_copy` in src/localshift/web_tools.py:233", "shortDescription": {"text": "Legacy-named symbol `model_copy` in src/localshift/web_tools.py:233"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b8809967e3e29162", "name": "Commented-code block (5 lines) in src/localshift/spec.py:17", "shortDescription": {"text": "Commented-code block (5 lines) in src/localshift/spec.py:17"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-736ddc0b967c50b3", "name": "Commented-code block (5 lines) in src/localshift/engine_local.py:236", "shortDescription": {"text": "Commented-code block (5 lines) in src/localshift/engine_local.py:236"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nsrc/localshift/web_tools.py:info, src/localshift/web_tools.py:info, src/localshift/web_tools.py:info\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/23971"}, "properties": {"repository": "ahwurm/localshift", "repoUrl": "https://github.com/ahwurm/localshift", "branch": "main"}, "results": [{"ruleId": "scanner-639fc8d623d078fd", "level": "note", "message": {"text": "Possibly dead Python function: handle_starttag"}, "properties": {"repobilityId": "3bf216d149959ebf", "scanner": "scanner-primary", "fingerprint": "639fc8d623d078fd", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/localshift/web_tools.py:64"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-840771db4b9f2516", "level": "note", "message": {"text": "Possibly dead Python function: handle_endtag"}, "properties": {"repobilityId": "7eb6f3decafc1766", "scanner": "scanner-primary", "fingerprint": "840771db4b9f2516", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/localshift/web_tools.py:68"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c11dd58c045f2b2a", "level": "note", "message": {"text": "Possibly dead Python function: handle_data"}, "properties": {"repobilityId": "3a673a278f4fc1e6", "scanner": "scanner-primary", "fingerprint": "c11dd58c045f2b2a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/localshift/web_tools.py:72"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "0decbe5ba693bed9", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ef17dd4b3c6516da", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/design-eval/SKILL.md"}, "properties": {"repobilityId": "9773001a56d08abe", "scanner": "scanner-primary", "fingerprint": "ef17dd4b3c6516da", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/design-eval/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0db4a3b2c59b8792", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/explore/SKILL.md"}, "properties": {"repobilityId": "88fa9facc6165cb2", "scanner": "scanner-primary", "fingerprint": "0db4a3b2c59b8792", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/explore/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4438101b547e5e7c", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/savings/SKILL.md"}, "properties": {"repobilityId": "f35cc139b83dded0", "scanner": "scanner-primary", "fingerprint": "4438101b547e5e7c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/savings/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7193a72f6d512095", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/evaluate/SKILL.md"}, "properties": {"repobilityId": "13e83485b12cf90d", "scanner": "scanner-primary", "fingerprint": "7193a72f6d512095", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/evaluate/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8fea4e3e51172133", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in src/localshift/web_tools.py:233"}, "properties": {"repobilityId": "e14f6e2aca61594e", "scanner": "scanner-primary", "fingerprint": "8fea4e3e51172133", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-b8809967e3e29162", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/localshift/spec.py:17"}, "properties": {"repobilityId": "76879cd10186004d", "scanner": "scanner-primary", "fingerprint": "b8809967e3e29162", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-736ddc0b967c50b3", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/localshift/engine_local.py:236"}, "properties": {"repobilityId": "4b906d2783e6fba8", "scanner": "scanner-primary", "fingerprint": "736ddc0b967c50b3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "c71e43a438eb7789", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}]}]}