{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-0ebc692d3078bcec", "name": "Stray `console.log` in TS/JS \u2014 docs/_next/static/chunks/239-83ef0991250577f2.js:1", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 docs/_next/static/chunks/239-83ef0991250577f2.js:1"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-97fdc876de546103", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 docs/_next/static/chunks/framework-bef83a85c94ff7de.js:1", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 docs/_next/static/chunks/framework-bef83a85c94ff7de.js:1"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-47011aee19eaf5ea", "name": "Stray `console.log` in TS/JS \u2014 docs/_next/static/chunks/main-90f1b3e7c6eff129.js:1", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 docs/_next/static/chunks/main-90f1b3e7c6eff129.js:1"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1a1b97fa5a7d10aa", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 docs/_next/static/chunks/main-90f1b3e7c6eff129.js:1", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 docs/_next/static/chunks/main-90f1b3e7c6eff129.js:1"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-953156e0c4faf0f7", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 docs/_next/static/chunks/f90a07c8-9e65582f7787e19c.js:1", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 docs/_next/static/chunks/f90a07c8-9e65582f7787e19c.js:1"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a1abbb5e1b2e30a7", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 docs/_next/static/chunks/app/_not-found/page-6066903ec71f1304.js:1", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 docs/_next/static/chunks/app/_not-found/page-6066903ec71f1304.js:1"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-225df6a14056538a", "name": "Stray `console.log` in TS/JS \u2014 scripts/audit-datums.ts:22", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/audit-datums.ts:22"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-681c205601ec87ff", "name": "TODO/FIXME marker in shipping code \u2014 packages/chain-vector/src/wallet.ts:57", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 packages/chain-vector/src/wallet.ts:57"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1096e133a822d7d9", "name": "Stray `console.log` in TS/JS \u2014 examples/agents/demo-agents/src/register.ts:24", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 examples/agents/demo-agents/src/register.ts:24"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f881925e81351333", "name": "Stray `console.log` in TS/JS \u2014 examples/agents/demo-agents/src/serve.ts:9", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 examples/agents/demo-agents/src/serve.ts:9"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7ffbc5a163cd0a40", "name": "TODO/FIXME marker in shipping code \u2014 services/refuel-api/src/bridges.ts:69", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 services/refuel-api/src/bridges.ts:69"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-831e9205493624c4", "name": "Stray `console.log` in TS/JS \u2014 services/refuel-api/src/main.ts:10", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 services/refuel-api/src/main.ts:10"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a53a6e01b4123d9f", "name": "TODO/FIXME marker in shipping code \u2014 services/conductor/src/executor.ts:256", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 services/conductor/src/executor.ts:256"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-234e918785cde7ae", "name": "TODO/FIXME marker in shipping code \u2014 services/conductor/src/taskstore.ts:164", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 services/conductor/src/taskstore.ts:164"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9a8b255a95d6c98d", "name": "Stray `console.log` in TS/JS \u2014 services/conductor/src/main.ts:13", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 services/conductor/src/main.ts:13"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a37a65ac8f120d70", "name": "TODO/FIXME marker in shipping code \u2014 services/conductor/src/verifier.ts:68", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 services/conductor/src/verifier.ts:68"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8f7ee03524a44c5f", "name": "Stray `console.log` in TS/JS \u2014 services/indexer/src/main.ts:12", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 services/indexer/src/main.ts:12"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a2a6110684ae3b7", "name": "Stray `console.log` in TS/JS \u2014 infra/migrations/run.ts:10", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 infra/migrations/run.ts:10"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-61ee39968b8aa858", "name": "Insecure pattern 'dangerous_innerhtml' in docs/tasks.html:1", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in docs/tasks.html:1"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7fe28ebd44ccf499", "name": "Insecure pattern 'dangerous_innerhtml' in docs/clients.html:7", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in docs/clients.html:7"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-eb083326176fdf89", "name": "Insecure pattern 'dangerous_innerhtml' in docs/agents.html:1", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in docs/agents.html:1"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f36242376eb4f87f", "name": "Insecure pattern 'dangerous_innerhtml' in docs/index.html:1", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in docs/index.html:1"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5e9019a5d21b2130", "name": "Insecure pattern 'dangerous_innerhtml' in docs/404.html:1", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in docs/404.html:1"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fc9109486811bddc", "name": "Insecure pattern 'dangerous_innerhtml' in docs/refuel.html:9", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in docs/refuel.html:9"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d59f9c1d90f5a2c1", "name": "Insecure pattern 'direct_innerhtml_assignment' in docs/_next/static/chunks/239-83ef0991250577f2.js:1", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in docs/_next/static/chunks/239-83ef0991250577f2.js:1"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-22bdda335e9ae254", "name": "Insecure pattern 'dangerous_innerhtml' in docs/_next/static/chunks/framework-bef83a85c94ff7de.js:1", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in docs/_next/static/chunks/framework-bef83a85c94ff7de.js:1"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-98c7f2080f48b060", "name": "Insecure pattern 'direct_innerhtml_assignment' in docs/_next/static/chunks/framework-bef83a85c94ff7de.js:1", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in docs/_next/static/chunks/framework-bef83a85c94ff7de.js:1"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c69b865ee4342cec", "name": "Insecure pattern 'dangerous_innerhtml' in docs/_next/static/chunks/main-90f1b3e7c6eff129.js:1", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in docs/_next/static/chunks/main-90f1b3e7c6eff129.js:1"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749974ad43e1d8a5", "name": "Insecure pattern 'direct_innerhtml_assignment' in docs/_next/static/chunks/main-90f1b3e7c6eff129.js:1", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in docs/_next/static/chunks/main-90f1b3e7c6eff129.js:1"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-81eaea87dbcac4a7", "name": "Insecure pattern 'dangerous_innerhtml' in docs/_next/static/chunks/f90a07c8-9e65582f7787e19c.js:1", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in docs/_next/static/chunks/f90a07c8-9e65582f7787e19c.js:1"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3d6d1265d93cb973", "name": "Insecure pattern 'direct_innerhtml_assignment' in docs/_next/static/chunks/f90a07c8-9e65582f7787e19c.js:1", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in docs/_next/static/chunks/f90a07c8-9e65582f7787e19c.js:1"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea88ecbd0b9dbdbc", "name": "Insecure pattern 'dangerous_innerhtml' in docs/_next/static/chunks/app/_not-found/page-6066903ec71f1304.js:1", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in docs/_next/static/chunks/app/_not-found/page-6066903ec71f1304.js:1"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "12 tests / 88 src (ratio 0.14)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4a9eb7dc7c6e3880", "name": "Node manifest has dependencies but no lockfile: apps/web/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/web/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fde2fab12c7b2f9d", "name": "Node manifest has dependencies but no lockfile: packages/chain-vector/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/chain-vector/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0d2d5d37d648adf2", "name": "Node manifest has dependencies but no lockfile: packages/chain-base/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/chain-base/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ce29d338ad0d1a63", "name": "Node manifest has dependencies but no lockfile: packages/x402/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/x402/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-28e92806c0db3cd2", "name": "Node manifest has dependencies but no lockfile: packages/core/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/core/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0633faea22883b1d", "name": "Node manifest has dependencies but no lockfile: packages/llm/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/llm/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4f88d336c2c18e5b", "name": "Node manifest has dependencies but no lockfile: examples/agents/demo-agents/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: examples/agents/demo-agents/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8685c08af8c67151", "name": "Node manifest has dependencies but no lockfile: services/refuel-api/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: services/refuel-api/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fed1216d7a9ac949", "name": "Node manifest has dependencies but no lockfile: services/conductor/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: services/conductor/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f3d6dbdff828d652", "name": "Node manifest has dependencies but no lockfile: services/indexer/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: services/indexer/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 32 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 18 placeholder/mock markers across 11 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, lockfile. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2c5f98b152cddb6d", "name": "Agent authority lacks a verifier contract: .claude/launch.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/launch.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5bd8e9019ca2ef04", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/web/lib/api.ts:114", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/web/lib/api.ts:114"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2dd727835ac7b6aa", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/web/lib/virtual-agents.ts:40", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/web/lib/virtual-agents.ts:40"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-64b03a734272a987", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/web/lib/static-mode.ts:7", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/web/lib/static-mode.ts:7"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-88a2cfecc44498c0", "name": "`fetch()` without try/.catch or AbortSignal \u2014 docs/_next/static/chunks/239-83ef0991250577f2.js:1", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 docs/_next/static/chunks/239-83ef0991250577f2.js:1"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0ae60bb50d3494b9", "name": "`fetch()` without try/.catch or AbortSignal \u2014 docs/_next/static/chunks/358.752b426e91185e71.js:1", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 docs/_next/static/chunks/358.752b426e91185e71.js:1"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-09e1dc99754c7251", "name": "`fetch()` without try/.catch or AbortSignal \u2014 docs/_next/static/chunks/370-84470940fdd0ef4c.js:1", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 docs/_next/static/chunks/370-84470940fdd0ef4c.js:1"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-07de372038467ce5", "name": "`fetch()` without try/.catch or AbortSignal \u2014 docs/_next/static/chunks/main-90f1b3e7c6eff129.js:1", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 docs/_next/static/chunks/main-90f1b3e7c6eff129.js:1"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-afcaa451d342a28f", "name": "`fetch()` without try/.catch or AbortSignal \u2014 docs/_next/static/chunks/805.87f5cb80dbe20de4.js:1", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 docs/_next/static/chunks/805.87f5cb80dbe20de4.js:1"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-810eac769938f264", "name": "`fetch()` without try/.catch or AbortSignal \u2014 docs/_next/static/chunks/app/page-04723f85b901d108.js:1", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 docs/_next/static/chunks/app/page-04723f85b901d108.js:1"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-66bec7fa0b4aa2bb", "name": "`fetch()` without try/.catch or AbortSignal \u2014 docs/_next/static/chunks/app/refuel/page-55b6d7358e76c693.js:1", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 docs/_next/static/chunks/app/refuel/page-55b6d7358e76c693.js:1"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-56fbc3bbcee6035d", "name": "`fetch()` without try/.catch or AbortSignal \u2014 docs/_next/static/chunks/app/tasks/page-db14e8959dd53ba4.js:1", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 docs/_next/static/chunks/app/tasks/page-db14e8959dd53ba4.js:1"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-70f8ca8398fe15d3", "name": "`fetch()` without try/.catch or AbortSignal \u2014 docs/_next/static/chunks/app/agents/page-5cf0d752c8c3da84.js:1", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 docs/_next/static/chunks/app/agents/page-5cf0d752c8c3da84.js:1"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-326f9aa7fab328f3", "name": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/e2e-local.mjs:23", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/e2e-local.mjs:23"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-af022f937dd5b7fd", "name": "9 env vars used in code but missing from .env.example", "shortDescription": {"text": "9 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `AGENT_BASE_PORT`, `AGENT_MNEMONIC`, `AGENT_PUBLIC_URL`, `CONDUCTOR_API_KEYS`, `CONDUCTOR_URL`, `NEXT_PUBLIC_BASE_PATH`, `NEXT_PUBLIC_STATIC`, `REFUEL_URL` + 1 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b5db04e4203d4d52", "name": "Dangling fetch: GET https://api.geckoterminal.com/api/v2/networks/base/pools/${BAP3X_POOL} (apps/web/lib/virtual-agents.", "shortDescription": {"text": "Dangling fetch: GET https://api.geckoterminal.com/api/v2/networks/base/pools/${BAP3X_POOL} (apps/web/lib/virtual-agents.ts:72)"}, "fullDescription": {"text": "`apps/web/lib/virtual-agents.ts:72` calls `GET https://api.geckoterminal.com/api/v2/networks/base/pools/${BAP3X_POOL}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.geckoterminal.com/api/v2/networks/base/pools/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-961faa7492878777", "name": "Dangling fetch: GET https://api.geckoterminal.com/api/v2/networks/base/pools/${BAP3X_POOL} (apps/web/lib/virtual-agents.", "shortDescription": {"text": "Dangling fetch: GET https://api.geckoterminal.com/api/v2/networks/base/pools/${BAP3X_POOL} (apps/web/lib/virtual-agents.ts:89)"}, "fullDescription": {"text": "`apps/web/lib/virtual-agents.ts:89` calls `GET https://api.geckoterminal.com/api/v2/networks/base/pools/${BAP3X_POOL}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.geckoterminal.com/api/v2/networks/base/pools/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3079bcd1b9cd5667", "name": "Dangling fetch: GET /tip (packages/chain-vector/src/koios.ts:74)", "shortDescription": {"text": "Dangling fetch: GET /tip (packages/chain-vector/src/koios.ts:74)"}, "fullDescription": {"text": "`packages/chain-vector/src/koios.ts:74` calls `GET /tip` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/tip`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3491c1c864ad9cb3", "name": "Dangling fetch: GET https://news.google.com/rss/search?q=${encodeURIComponent(topic)}&hl=en-US&gl=US&ceid=US:en (example", "shortDescription": {"text": "Dangling fetch: GET https://news.google.com/rss/search?q=${encodeURIComponent(topic)}&hl=en-US&gl=US&ceid=US:en (examples/agents/demo-agents/src/index.ts:58)"}, "fullDescription": {"text": "`examples/agents/demo-agents/src/index.ts:58` calls `GET https://news.google.com/rss/search?q=${encodeURIComponent(topic)}&hl=en-US&gl=US&ceid=US:en` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/news.google.com/rss/search`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d7d5ceb843a729bb", "name": "Dangling fetch: GET https://api.coingecko.com/api/v3/simple/price?ids=apex-fusion&vs_currencies=usd (examples/agents/dem", "shortDescription": {"text": "Dangling fetch: GET https://api.coingecko.com/api/v3/simple/price?ids=apex-fusion&vs_currencies=usd (examples/agents/demo-agents/src/index.ts:150)"}, "fullDescription": {"text": "`examples/agents/demo-agents/src/index.ts:150` calls `GET https://api.coingecko.com/api/v3/simple/price?ids=apex-fusion&vs_currencies=usd` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.coingecko.com/api/v3/simple/price`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-91b7d4e1cde07e8d", "name": "Unused endpoint: POST ", "shortDescription": {"text": "Unused endpoint: POST "}, "fullDescription": {"text": "`docs/_next/static/chunks/app/clients/page-98f9c04cc4771a18.js` declares `POST ` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a009b1a56794f45", "name": "Unused endpoint: POST /", "shortDescription": {"text": "Unused endpoint: POST /"}, "fullDescription": {"text": "`examples/agents/demo-agents/src/index.ts` declares `POST /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-22166853e3335b92", "name": "Unused endpoint: POST /v1/refuel", "shortDescription": {"text": "Unused endpoint: POST /v1/refuel"}, "fullDescription": {"text": "`services/refuel-api/src/server.ts` declares `POST /v1/refuel` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-89b2488bf045e85f", "name": "Unused endpoint: GET /v1/gas/:vectorAddress", "shortDescription": {"text": "Unused endpoint: GET /v1/gas/:vectorAddress"}, "fullDescription": {"text": "`services/refuel-api/src/server.ts` declares `GET /v1/gas/:vectorAddress` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b11e23ebb82dbf48", "name": "Unused endpoint: POST /v1/gas/topup", "shortDescription": {"text": "Unused endpoint: POST /v1/gas/topup"}, "fullDescription": {"text": "`services/refuel-api/src/server.ts` declares `POST /v1/gas/topup` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-84cf759495734b24", "name": "Unused endpoint: GET /mcp/sse", "shortDescription": {"text": "Unused endpoint: GET /mcp/sse"}, "fullDescription": {"text": "`services/conductor/src/mcp.ts` declares `GET /mcp/sse` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e0d20bced1980c22", "name": "Unused endpoint: POST /mcp/messages", "shortDescription": {"text": "Unused endpoint: POST /mcp/messages"}, "fullDescription": {"text": "`services/conductor/src/mcp.ts` declares `POST /mcp/messages` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bc4c1ec998142424", "name": "Unused endpoint: POST /v1/intents", "shortDescription": {"text": "Unused endpoint: POST /v1/intents"}, "fullDescription": {"text": "`services/conductor/src/server.ts` declares `POST /v1/intents` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1fbfd442c6c4a695", "name": "Unused endpoint: GET /v1/tasks/:id", "shortDescription": {"text": "Unused endpoint: GET /v1/tasks/:id"}, "fullDescription": {"text": "`services/conductor/src/server.ts` declares `GET /v1/tasks/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-24fcdeeaa6147500", "name": "Unused endpoint: GET /v1/tasks/:id/events", "shortDescription": {"text": "Unused endpoint: GET /v1/tasks/:id/events"}, "fullDescription": {"text": "`services/conductor/src/server.ts` declares `GET /v1/tasks/:id/events` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3f8e44b19233a2ce", "name": "Unused endpoint: POST /v1/tasks/:id/approve", "shortDescription": {"text": "Unused endpoint: POST /v1/tasks/:id/approve"}, "fullDescription": {"text": "`services/conductor/src/server.ts` declares `POST /v1/tasks/:id/approve` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d5ab01b45a5118a3", "name": "Unused endpoint: POST /v1/tasks/:id/cancel", "shortDescription": {"text": "Unused endpoint: POST /v1/tasks/:id/cancel"}, "fullDescription": {"text": "`services/conductor/src/server.ts` declares `POST /v1/tasks/:id/cancel` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-84057142251b292f", "name": "Unused endpoint: GET /v1/agents", "shortDescription": {"text": "Unused endpoint: GET /v1/agents"}, "fullDescription": {"text": "`services/conductor/src/server.ts` declares `GET /v1/agents` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-61558619e7283756", "name": "Unused endpoint: POST /v1/agents/:agentId/manifest", "shortDescription": {"text": "Unused endpoint: POST /v1/agents/:agentId/manifest"}, "fullDescription": {"text": "`services/conductor/src/server.ts` declares `POST /v1/agents/:agentId/manifest` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3140e61d7cac5091", "name": "Unused endpoint: GET /agents", "shortDescription": {"text": "Unused endpoint: GET /agents"}, "fullDescription": {"text": "`services/indexer/src/main.ts` declares `GET /agents` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/18987"}, "properties": {"repository": "satoshigreek/apex-conductor", "repoUrl": "https://github.com/satoshigreek/apex-conductor", "branch": "main"}, "results": [{"ruleId": "scanner-0ebc692d3078bcec", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 docs/_next/static/chunks/239-83ef0991250577f2.js:1"}, "properties": {"repobilityId": "70511b5cbcb95f7c", "scanner": "scanner-primary", "fingerprint": "0ebc692d3078bcec", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-97fdc876de546103", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 docs/_next/static/chunks/framework-bef83a85c94ff7de.js:1"}, "properties": {"repobilityId": "a63fd5a27270da03", "scanner": "scanner-primary", "fingerprint": "97fdc876de546103", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-47011aee19eaf5ea", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 docs/_next/static/chunks/main-90f1b3e7c6eff129.js:1"}, "properties": {"repobilityId": "1d7526cc5eb1874a", "scanner": "scanner-primary", "fingerprint": "47011aee19eaf5ea", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-1a1b97fa5a7d10aa", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 docs/_next/static/chunks/main-90f1b3e7c6eff129.js:1"}, "properties": {"repobilityId": "bedba09f1ad8f61b", "scanner": "scanner-primary", "fingerprint": "1a1b97fa5a7d10aa", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-953156e0c4faf0f7", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 docs/_next/static/chunks/f90a07c8-9e65582f7787e19c.js:1"}, "properties": {"repobilityId": "cd6a6b0ac6eadc63", "scanner": "scanner-primary", "fingerprint": "953156e0c4faf0f7", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-a1abbb5e1b2e30a7", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 docs/_next/static/chunks/app/_not-found/page-6066903ec71f1304.js:1"}, "properties": {"repobilityId": "efa34c4584657c7c", "scanner": "scanner-primary", "fingerprint": "a1abbb5e1b2e30a7", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-225df6a14056538a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/audit-datums.ts:22"}, "properties": {"repobilityId": "6b4d08786c1c03f0", "scanner": "scanner-primary", "fingerprint": "225df6a14056538a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-681c205601ec87ff", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 packages/chain-vector/src/wallet.ts:57"}, "properties": {"repobilityId": "89ec311f8ec7e453", "scanner": "scanner-primary", "fingerprint": "681c205601ec87ff", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-1096e133a822d7d9", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 examples/agents/demo-agents/src/register.ts:24"}, "properties": {"repobilityId": "a8e739fcd832d438", "scanner": "scanner-primary", "fingerprint": "1096e133a822d7d9", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-f881925e81351333", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 examples/agents/demo-agents/src/serve.ts:9"}, "properties": {"repobilityId": "8c838a0b62a556bb", "scanner": "scanner-primary", "fingerprint": "f881925e81351333", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-7ffbc5a163cd0a40", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 services/refuel-api/src/bridges.ts:69"}, "properties": {"repobilityId": "d208a21dd00196ad", "scanner": "scanner-primary", "fingerprint": "7ffbc5a163cd0a40", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-831e9205493624c4", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 services/refuel-api/src/main.ts:10"}, "properties": {"repobilityId": "11b90bf0c7bc6a85", "scanner": "scanner-primary", "fingerprint": "831e9205493624c4", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a53a6e01b4123d9f", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 services/conductor/src/executor.ts:256"}, "properties": {"repobilityId": "fa535f64203b6a70", "scanner": "scanner-primary", "fingerprint": "a53a6e01b4123d9f", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-234e918785cde7ae", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 services/conductor/src/taskstore.ts:164"}, "properties": {"repobilityId": "9988825e9d5d3108", "scanner": "scanner-primary", "fingerprint": "234e918785cde7ae", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-9a8b255a95d6c98d", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 services/conductor/src/main.ts:13"}, "properties": {"repobilityId": "54dae9470293813f", "scanner": "scanner-primary", "fingerprint": "9a8b255a95d6c98d", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a37a65ac8f120d70", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 services/conductor/src/verifier.ts:68"}, "properties": {"repobilityId": "c46dbb14bb3e7323", "scanner": "scanner-primary", "fingerprint": "a37a65ac8f120d70", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-8f7ee03524a44c5f", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 services/indexer/src/main.ts:12"}, "properties": {"repobilityId": "4fbdaa7f8ce3c2c4", "scanner": "scanner-primary", "fingerprint": "8f7ee03524a44c5f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-7a2a6110684ae3b7", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 infra/migrations/run.ts:10"}, "properties": {"repobilityId": "1af727befd67bb8b", "scanner": "scanner-primary", "fingerprint": "7a2a6110684ae3b7", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-61ee39968b8aa858", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in docs/tasks.html:1"}, "properties": {"repobilityId": "9831000b70632586", "scanner": "scanner-primary", "fingerprint": "61ee39968b8aa858", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/tasks.html"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7fe28ebd44ccf499", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in docs/clients.html:7"}, "properties": {"repobilityId": "8a96785257d6f67a", "scanner": "scanner-primary", "fingerprint": "7fe28ebd44ccf499", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/clients.html"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-eb083326176fdf89", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in docs/agents.html:1"}, "properties": {"repobilityId": "2c10335c3ed90ee9", "scanner": "scanner-primary", "fingerprint": "eb083326176fdf89", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/agents.html"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f36242376eb4f87f", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in docs/index.html:1"}, "properties": {"repobilityId": "6314a2320f188cd8", "scanner": "scanner-primary", "fingerprint": "f36242376eb4f87f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/index.html"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5e9019a5d21b2130", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in docs/404.html:1"}, "properties": {"repobilityId": "ed589d538c23c241", "scanner": "scanner-primary", "fingerprint": "5e9019a5d21b2130", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/404.html"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fc9109486811bddc", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in docs/refuel.html:9"}, "properties": {"repobilityId": "52514287b820063a", "scanner": "scanner-primary", "fingerprint": "fc9109486811bddc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/refuel.html"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-d59f9c1d90f5a2c1", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in docs/_next/static/chunks/239-83ef0991250577f2.js:1"}, "properties": {"repobilityId": "deb0da7954b4e2d4", "scanner": "scanner-primary", "fingerprint": "d59f9c1d90f5a2c1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/_next/static/chunks/239-83ef0991250577f2.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-22bdda335e9ae254", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in docs/_next/static/chunks/framework-bef83a85c94ff7de.js:1"}, "properties": {"repobilityId": "33e154dee9281d10", "scanner": "scanner-primary", "fingerprint": "22bdda335e9ae254", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/_next/static/chunks/framework-bef83a85c94ff7de.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-98c7f2080f48b060", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in docs/_next/static/chunks/framework-bef83a85c94ff7de.js:1"}, "properties": {"repobilityId": "5674f09bc0350536", "scanner": "scanner-primary", "fingerprint": "98c7f2080f48b060", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/_next/static/chunks/framework-bef83a85c94ff7de.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c69b865ee4342cec", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in docs/_next/static/chunks/main-90f1b3e7c6eff129.js:1"}, "properties": {"repobilityId": "9b4e8c59953285a2", "scanner": "scanner-primary", "fingerprint": "c69b865ee4342cec", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/_next/static/chunks/main-90f1b3e7c6eff129.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-749974ad43e1d8a5", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in docs/_next/static/chunks/main-90f1b3e7c6eff129.js:1"}, "properties": {"repobilityId": "75a076b3996ffe2e", "scanner": "scanner-primary", "fingerprint": "749974ad43e1d8a5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/_next/static/chunks/main-90f1b3e7c6eff129.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-81eaea87dbcac4a7", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in docs/_next/static/chunks/f90a07c8-9e65582f7787e19c.js:1"}, "properties": {"repobilityId": "6f043dc65ecab145", "scanner": "scanner-primary", "fingerprint": "81eaea87dbcac4a7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/_next/static/chunks/f90a07c8-9e65582f7787e19c.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3d6d1265d93cb973", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in docs/_next/static/chunks/f90a07c8-9e65582f7787e19c.js:1"}, "properties": {"repobilityId": "f7071ba34fda79e2", "scanner": "scanner-primary", "fingerprint": "3d6d1265d93cb973", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/_next/static/chunks/f90a07c8-9e65582f7787e19c.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ea88ecbd0b9dbdbc", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in docs/_next/static/chunks/app/_not-found/page-6066903ec71f1304.js:1"}, "properties": {"repobilityId": "ea8c4f89418fbe2a", "scanner": "scanner-primary", "fingerprint": "ea88ecbd0b9dbdbc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/_next/static/chunks/app/_not-found/page-6066903ec71f1304.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "dca698b71bfbbd20", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-4a9eb7dc7c6e3880", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/web/package.json"}, "properties": {"repobilityId": "6c1704bf24cf19ac", "scanner": "scanner-primary", "fingerprint": "4a9eb7dc7c6e3880", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fde2fab12c7b2f9d", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/chain-vector/package.json"}, "properties": {"repobilityId": "a676db98c710f5f0", "scanner": "scanner-primary", "fingerprint": "fde2fab12c7b2f9d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/chain-vector/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0d2d5d37d648adf2", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/chain-base/package.json"}, "properties": {"repobilityId": "bcffe47aad84454a", "scanner": "scanner-primary", "fingerprint": "0d2d5d37d648adf2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/chain-base/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ce29d338ad0d1a63", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/x402/package.json"}, "properties": {"repobilityId": "1f430fc5147e3139", "scanner": "scanner-primary", "fingerprint": "ce29d338ad0d1a63", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/x402/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-28e92806c0db3cd2", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/core/package.json"}, "properties": {"repobilityId": "8640e46be7e3f9b2", "scanner": "scanner-primary", "fingerprint": "28e92806c0db3cd2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/core/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0633faea22883b1d", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/llm/package.json"}, "properties": {"repobilityId": "4c7db7c73e8d888a", "scanner": "scanner-primary", "fingerprint": "0633faea22883b1d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/llm/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4f88d336c2c18e5b", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: examples/agents/demo-agents/package.json"}, "properties": {"repobilityId": "228e0845deebd7d7", "scanner": "scanner-primary", "fingerprint": "4f88d336c2c18e5b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "examples/agents/demo-agents/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8685c08af8c67151", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: services/refuel-api/package.json"}, "properties": {"repobilityId": "1c71683e414f3657", "scanner": "scanner-primary", "fingerprint": "8685c08af8c67151", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "services/refuel-api/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fed1216d7a9ac949", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: services/conductor/package.json"}, "properties": {"repobilityId": "ffd96efd0c8b174f", "scanner": "scanner-primary", "fingerprint": "fed1216d7a9ac949", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "services/conductor/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f3d6dbdff828d652", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: services/indexer/package.json"}, "properties": {"repobilityId": "a83fd232cea8b186", "scanner": "scanner-primary", "fingerprint": "f3d6dbdff828d652", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "services/indexer/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "862e65f66fc1b654", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "358c7ea8c20a75e1", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "182d833f1e4d19cb", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "f5ff8bf21cb7b3c2", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "2da561b81c9505e7", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "1e0ccd1d389408f0", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "9fa5c2488b6ad99e", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-2c5f98b152cddb6d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/launch.json"}, "properties": {"repobilityId": "0de48c0f4ab303d8", "scanner": "scanner-primary", "fingerprint": "2c5f98b152cddb6d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/launch.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5bd8e9019ca2ef04", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/web/lib/api.ts:114"}, "properties": {"repobilityId": "22c811f3429c0b1c", "scanner": "scanner-primary", "fingerprint": "5bd8e9019ca2ef04", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2dd727835ac7b6aa", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/web/lib/virtual-agents.ts:40"}, "properties": {"repobilityId": "bda704fa713be71b", "scanner": "scanner-primary", "fingerprint": "2dd727835ac7b6aa", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-64b03a734272a987", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/web/lib/static-mode.ts:7"}, "properties": {"repobilityId": "3cbd81a93644a4bc", "scanner": "scanner-primary", "fingerprint": "64b03a734272a987", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-88a2cfecc44498c0", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 docs/_next/static/chunks/239-83ef0991250577f2.js:1"}, "properties": {"repobilityId": "f5b804469f6deb68", "scanner": "scanner-primary", "fingerprint": "88a2cfecc44498c0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-0ae60bb50d3494b9", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 docs/_next/static/chunks/358.752b426e91185e71.js:1"}, "properties": {"repobilityId": "67b06bf12cd1f8d7", "scanner": "scanner-primary", "fingerprint": "0ae60bb50d3494b9", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-09e1dc99754c7251", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 docs/_next/static/chunks/370-84470940fdd0ef4c.js:1"}, "properties": {"repobilityId": "9d3234971caf9ac6", "scanner": "scanner-primary", "fingerprint": "09e1dc99754c7251", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-07de372038467ce5", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 docs/_next/static/chunks/main-90f1b3e7c6eff129.js:1"}, "properties": {"repobilityId": "e4ffd33674686717", "scanner": "scanner-primary", "fingerprint": "07de372038467ce5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-afcaa451d342a28f", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 docs/_next/static/chunks/805.87f5cb80dbe20de4.js:1"}, "properties": {"repobilityId": "8aa5d0319659c386", "scanner": "scanner-primary", "fingerprint": "afcaa451d342a28f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-810eac769938f264", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 docs/_next/static/chunks/app/page-04723f85b901d108.js:1"}, "properties": {"repobilityId": "83a71a6bf1f0b871", "scanner": "scanner-primary", "fingerprint": "810eac769938f264", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-66bec7fa0b4aa2bb", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 docs/_next/static/chunks/app/refuel/page-55b6d7358e76c693.js:1"}, "properties": {"repobilityId": "9b0ee4d1eba08983", "scanner": "scanner-primary", "fingerprint": "66bec7fa0b4aa2bb", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-56fbc3bbcee6035d", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 docs/_next/static/chunks/app/tasks/page-db14e8959dd53ba4.js:1"}, "properties": {"repobilityId": "53bf6c67bd0fac10", "scanner": "scanner-primary", "fingerprint": "56fbc3bbcee6035d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-70f8ca8398fe15d3", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 docs/_next/static/chunks/app/agents/page-5cf0d752c8c3da84.js:1"}, "properties": {"repobilityId": "eae47251a58c269e", "scanner": "scanner-primary", "fingerprint": "70f8ca8398fe15d3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-326f9aa7fab328f3", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/e2e-local.mjs:23"}, "properties": {"repobilityId": "24af655fb355fb8a", "scanner": "scanner-primary", "fingerprint": "326f9aa7fab328f3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-af022f937dd5b7fd", "level": "note", "message": {"text": "9 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "5597384795dea7a4", "scanner": "scanner-primary", "fingerprint": "af022f937dd5b7fd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-b5db04e4203d4d52", "level": "error", "message": {"text": "Dangling fetch: GET https://api.geckoterminal.com/api/v2/networks/base/pools/${BAP3X_POOL} (apps/web/lib/virtual-agents.ts:72)"}, "properties": {"repobilityId": "b1b49dbab3c6aedc", "scanner": "scanner-primary", "fingerprint": "b5db04e4203d4d52", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-961faa7492878777", "level": "error", "message": {"text": "Dangling fetch: GET https://api.geckoterminal.com/api/v2/networks/base/pools/${BAP3X_POOL} (apps/web/lib/virtual-agents.ts:89)"}, "properties": {"repobilityId": "4dce17e9151121e2", "scanner": "scanner-primary", "fingerprint": "961faa7492878777", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-3079bcd1b9cd5667", "level": "error", "message": {"text": "Dangling fetch: GET /tip (packages/chain-vector/src/koios.ts:74)"}, "properties": {"repobilityId": "331041b4fcf31193", "scanner": "scanner-primary", "fingerprint": "3079bcd1b9cd5667", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-3491c1c864ad9cb3", "level": "error", "message": {"text": "Dangling fetch: GET https://news.google.com/rss/search?q=${encodeURIComponent(topic)}&hl=en-US&gl=US&ceid=US:en (examples/agents/demo-agents/src/index.ts:58)"}, "properties": {"repobilityId": "87d0c9b8eda8bd4c", "scanner": "scanner-primary", "fingerprint": "3491c1c864ad9cb3", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-d7d5ceb843a729bb", "level": "error", "message": {"text": "Dangling fetch: GET https://api.coingecko.com/api/v3/simple/price?ids=apex-fusion&vs_currencies=usd (examples/agents/demo-agents/src/index.ts:150)"}, "properties": {"repobilityId": "25b233007b1c2c59", "scanner": "scanner-primary", "fingerprint": "d7d5ceb843a729bb", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-91b7d4e1cde07e8d", "level": "note", "message": {"text": "Unused endpoint: POST "}, "properties": {"repobilityId": "e7bb5bef7ca5a8fb", "scanner": "scanner-primary", "fingerprint": "91b7d4e1cde07e8d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7a009b1a56794f45", "level": "note", "message": {"text": "Unused endpoint: POST /"}, "properties": {"repobilityId": "1f3df5633b8c48d4", "scanner": "scanner-primary", "fingerprint": "7a009b1a56794f45", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-22166853e3335b92", "level": "note", "message": {"text": "Unused endpoint: POST /v1/refuel"}, "properties": {"repobilityId": "ec7955d254186d15", "scanner": "scanner-primary", "fingerprint": "22166853e3335b92", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-89b2488bf045e85f", "level": "note", "message": {"text": "Unused endpoint: GET /v1/gas/:vectorAddress"}, "properties": {"repobilityId": "3cbb9c4b06eafded", "scanner": "scanner-primary", "fingerprint": "89b2488bf045e85f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b11e23ebb82dbf48", "level": "note", "message": {"text": "Unused endpoint: POST /v1/gas/topup"}, "properties": {"repobilityId": "9775834a427363f1", "scanner": "scanner-primary", "fingerprint": "b11e23ebb82dbf48", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-84cf759495734b24", "level": "note", "message": {"text": "Unused endpoint: GET /mcp/sse"}, "properties": {"repobilityId": "ed7ecac6ffddb6d0", "scanner": "scanner-primary", "fingerprint": "84cf759495734b24", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e0d20bced1980c22", "level": "note", "message": {"text": "Unused endpoint: POST /mcp/messages"}, "properties": {"repobilityId": "4227076a153044f4", "scanner": "scanner-primary", "fingerprint": "e0d20bced1980c22", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bc4c1ec998142424", "level": "note", "message": {"text": "Unused endpoint: POST /v1/intents"}, "properties": {"repobilityId": "9ae548db8283bc40", "scanner": "scanner-primary", "fingerprint": "bc4c1ec998142424", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1fbfd442c6c4a695", "level": "note", "message": {"text": "Unused endpoint: GET /v1/tasks/:id"}, "properties": {"repobilityId": "e5f176d08ec5f904", "scanner": "scanner-primary", "fingerprint": "1fbfd442c6c4a695", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-24fcdeeaa6147500", "level": "note", "message": {"text": "Unused endpoint: GET /v1/tasks/:id/events"}, "properties": {"repobilityId": "d3aea9bd9df8215c", "scanner": "scanner-primary", "fingerprint": "24fcdeeaa6147500", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3f8e44b19233a2ce", "level": "note", "message": {"text": "Unused endpoint: POST /v1/tasks/:id/approve"}, "properties": {"repobilityId": "84256b4dc18f984a", "scanner": "scanner-primary", "fingerprint": "3f8e44b19233a2ce", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d5ab01b45a5118a3", "level": "note", "message": {"text": "Unused endpoint: POST /v1/tasks/:id/cancel"}, "properties": {"repobilityId": "31c0b20382f8ae86", "scanner": "scanner-primary", "fingerprint": "d5ab01b45a5118a3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-84057142251b292f", "level": "note", "message": {"text": "Unused endpoint: GET /v1/agents"}, "properties": {"repobilityId": "0524936c488909da", "scanner": "scanner-primary", "fingerprint": "84057142251b292f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-61558619e7283756", "level": "note", "message": {"text": "Unused endpoint: POST /v1/agents/:agentId/manifest"}, "properties": {"repobilityId": "96071bfcf5d36cab", "scanner": "scanner-primary", "fingerprint": "61558619e7283756", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3140e61d7cac5091", "level": "note", "message": {"text": "Unused endpoint: GET /agents"}, "properties": {"repobilityId": "55fff58117edee08", "scanner": "scanner-primary", "fingerprint": "3140e61d7cac5091", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}