{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-fe889e36761d83d2", "name": "Privileged port 10 in use", "shortDescription": {"text": "Privileged port 10 in use"}, "fullDescription": {"text": "Port 10 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f4250418555a9cef", "name": "Privileged port 9 in use", "shortDescription": {"text": "Privileged port 9 in use"}, "fullDescription": {"text": "Port 9 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ccbe9956718ca624", "name": "Insecure pattern 'eval_used' in skills/repair/SKILL.md:85", "shortDescription": {"text": "Insecure pattern 'eval_used' in skills/repair/SKILL.md:85"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 6 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: ci, tests. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing ci, tests. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-00eae42148428839", "name": "Agent authority lacks a verifier contract: projects/CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: projects/CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-53a8edf52b17f573", "name": "Agent authority lacks a verifier contract: workspace/CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: workspace/CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-957edabf09c9ebe2", "name": "Agent authority lacks a verifier contract: pages/CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: pages/CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d0d4c83c310b8548", "name": "Agent authority lacks a verifier contract: .claude/rules/rill-data-model.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/rules/rill-data-model.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e4031664c3574a00", "name": "Agent authority lacks a verifier contract: .claude/rules/rill-claude-code-integration.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/rules/rill-claude-code-integration.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8ac1e94c06f0cbe2", "name": "Agent authority lacks a verifier contract: .claude/rules/rill-projects.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/rules/rill-projects.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6e70c195411a689d", "name": "Agent authority lacks a verifier contract: .claude/rules/rill-workspace.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/rules/rill-workspace.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3bcdeb301f365529", "name": "Agent instruction/config may expose a secret: .claude/rules/rill-tasks.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/rules/rill-tasks.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ba5d400e20001dcb", "name": "Agent authority lacks a verifier contract: .claude/rules/rill-core.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/rules/rill-core.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2156b04ace78c6ae", "name": "Agent authority lacks a verifier contract: .claude/commands/focus.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/focus.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e67ff978da23cb37", "name": "Agent authority lacks a verifier contract: .claude/commands/clip-tweet.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/clip-tweet.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dec05fdc527bab31", "name": "Agent authority lacks a verifier contract: .claude/commands/sync.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/sync.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5baa5b57c5c00ce9", "name": "Agent authority lacks a verifier contract: .claude/commands/maintain.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/maintain.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0da813324024de69", "name": "Agent authority lacks a verifier contract: .claude/commands/morning.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/morning.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ce4827e988aec446", "name": "Agent authority lacks a verifier contract: .claude/commands/briefing.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/briefing.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3d26b7f27823a4a1", "name": "Agent authority lacks a verifier contract: .claude/commands/_distill/refresh-agent.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/_distill/refresh-agent.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-16f7fedbd5f9595f", "name": "Agent authority lacks a verifier contract: .claude/commands/_distill/knowledge-agent.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/_distill/knowledge-agent.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bc01d3316fe0cdbb", "name": "Agent authority lacks a verifier contract: .claude/commands/_distill/journal-agent.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/_distill/journal-agent.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9eccef9423d04be4", "name": "Agent authority lacks a verifier contract: .claude/commands/_distill/think-output-agent.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/_distill/think-output-agent.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a09cda6cff76d6a4", "name": "Agent authority lacks a verifier contract: .claude/commands/_distill/task-extraction.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/_distill/task-extraction.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-237e9c32432d9dc3", "name": "Agent authority lacks a verifier contract: .claude/commands/_retrospective/theme-extraction-agent.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/_retrospective/theme-extraction-agent.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cf78b63fdb6a9966", "name": "Agent authority lacks a verifier contract: .claude/templates/sub-agent-template.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/templates/sub-agent-template.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-243e67fabcb77ba6", "name": "Agent authority lacks a verifier contract: reports/daily/CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: reports/daily/CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4dc27fdf9e0c1a83", "name": "Agent authority lacks a verifier contract: reports/newsletter/CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: reports/newsletter/CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4cd33eccb3022086", "name": "Agent authority lacks a verifier contract: skills/clip-tweet/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/clip-tweet/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1f477407c38a1b38", "name": "Agent authority lacks a verifier contract: skills/pulse/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/pulse/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3cab8e0b89a932e4", "name": "Agent authority lacks a verifier contract: skills/focus/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/focus/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fcc69bc446b5cc5e", "name": "Agent authority lacks a verifier contract: skills/maintain/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/maintain/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9234af3688069f90", "name": "Agent authority lacks a verifier contract: skills/morning/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/morning/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-01c804260b4de20f", "name": "Agent authority lacks a verifier contract: skills/briefing/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/briefing/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-83b558dee0414578", "name": "Agent authority lacks a verifier contract: inbox/CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: inbox/CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d0b11f348377cd49", "name": "Agent authority lacks a verifier contract: inbox/journal/CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: inbox/journal/CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-689e776d5b97389c", "name": "Agent authority lacks a verifier contract: knowledge/orgs/CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: knowledge/orgs/CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7de8e8d929e214d4", "name": "Agent authority lacks a verifier contract: knowledge/people/CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: knowledge/people/CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/18168"}, "properties": {"repository": "rillmd/rill", "repoUrl": "https://github.com/rillmd/rill", "branch": "main"}, "results": [{"ruleId": "scanner-fe889e36761d83d2", "level": "warning", "message": {"text": "Privileged port 10 in use"}, "properties": {"repobilityId": "735372d6b5594915", "scanner": "scanner-primary", "fingerprint": "fe889e36761d83d2", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugins/_lib.sh"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f4250418555a9cef", "level": "warning", "message": {"text": "Privileged port 9 in use"}, "properties": {"repobilityId": "31590a6ba3409390", "scanner": "scanner-primary", "fingerprint": "f4250418555a9cef", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugins/_lib.sh"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-ccbe9956718ca624", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in skills/repair/SKILL.md:85"}, "properties": {"repobilityId": "6cbb8ded26103baf", "scanner": "scanner-primary", "fingerprint": "ccbe9956718ca624", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/repair/SKILL.md"}, "region": {"startLine": 85}}}]}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "2187115534fc4c3f", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "44fe617a2038ea16", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "7ac8dbcff0604cd4", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "21b40b0c124a7a5c", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "c47320ee33329552", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-00eae42148428839", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: projects/CLAUDE.md"}, "properties": {"repobilityId": "2e3a1cebab235332", "scanner": "scanner-primary", "fingerprint": "00eae42148428839", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "projects/CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-53a8edf52b17f573", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: workspace/CLAUDE.md"}, "properties": {"repobilityId": "945ab34b21541081", "scanner": "scanner-primary", "fingerprint": "53a8edf52b17f573", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "workspace/CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-957edabf09c9ebe2", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: pages/CLAUDE.md"}, "properties": {"repobilityId": "09f8e8ba9cbb2b65", "scanner": "scanner-primary", "fingerprint": "957edabf09c9ebe2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pages/CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d0d4c83c310b8548", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/rules/rill-data-model.md"}, "properties": {"repobilityId": "1a1095dccd7e3097", "scanner": "scanner-primary", "fingerprint": "d0d4c83c310b8548", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/rules/rill-data-model.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e4031664c3574a00", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/rules/rill-claude-code-integration.md"}, "properties": {"repobilityId": "5de4c72b80a50ea3", "scanner": "scanner-primary", "fingerprint": "e4031664c3574a00", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/rules/rill-claude-code-integration.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8ac1e94c06f0cbe2", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/rules/rill-projects.md"}, "properties": {"repobilityId": "03bfb5b61f480cd2", "scanner": "scanner-primary", "fingerprint": "8ac1e94c06f0cbe2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/rules/rill-projects.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6e70c195411a689d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/rules/rill-workspace.md"}, "properties": {"repobilityId": "649412e67aa56376", "scanner": "scanner-primary", "fingerprint": "6e70c195411a689d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/rules/rill-workspace.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3bcdeb301f365529", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/rules/rill-tasks.md"}, "properties": {"repobilityId": "a014780efea49aaa", "scanner": "scanner-primary", "fingerprint": "3bcdeb301f365529", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/rules/rill-tasks.md"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-ba5d400e20001dcb", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/rules/rill-core.md"}, "properties": {"repobilityId": "4a1e2cc71c065f91", "scanner": "scanner-primary", "fingerprint": "ba5d400e20001dcb", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/rules/rill-core.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2156b04ace78c6ae", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/focus.md"}, "properties": {"repobilityId": "930f93624f40e943", "scanner": "scanner-primary", "fingerprint": "2156b04ace78c6ae", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/focus.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e67ff978da23cb37", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/clip-tweet.md"}, "properties": {"repobilityId": "09d77c77e8e58066", "scanner": "scanner-primary", "fingerprint": "e67ff978da23cb37", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/clip-tweet.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dec05fdc527bab31", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/sync.md"}, "properties": {"repobilityId": "13d2d3fdf297dfdc", "scanner": "scanner-primary", "fingerprint": "dec05fdc527bab31", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/sync.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5baa5b57c5c00ce9", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/maintain.md"}, "properties": {"repobilityId": "38ee8113ae623955", "scanner": "scanner-primary", "fingerprint": "5baa5b57c5c00ce9", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/maintain.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0da813324024de69", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/morning.md"}, "properties": {"repobilityId": "ed50e63e5763a698", "scanner": "scanner-primary", "fingerprint": "0da813324024de69", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/morning.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ce4827e988aec446", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/briefing.md"}, "properties": {"repobilityId": "53657f00a3e037c4", "scanner": "scanner-primary", "fingerprint": "ce4827e988aec446", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/briefing.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3d26b7f27823a4a1", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/_distill/refresh-agent.md"}, "properties": {"repobilityId": "255f88e3b9d59a0f", "scanner": "scanner-primary", "fingerprint": "3d26b7f27823a4a1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/_distill/refresh-agent.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-16f7fedbd5f9595f", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/_distill/knowledge-agent.md"}, "properties": {"repobilityId": "a6c9f345a9b763bf", "scanner": "scanner-primary", "fingerprint": "16f7fedbd5f9595f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/_distill/knowledge-agent.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bc01d3316fe0cdbb", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/_distill/journal-agent.md"}, "properties": {"repobilityId": "a055e3a69179dc65", "scanner": "scanner-primary", "fingerprint": "bc01d3316fe0cdbb", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/_distill/journal-agent.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9eccef9423d04be4", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/_distill/think-output-agent.md"}, "properties": {"repobilityId": "54f2ba51fad66f72", "scanner": "scanner-primary", "fingerprint": "9eccef9423d04be4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/_distill/think-output-agent.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a09cda6cff76d6a4", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/_distill/task-extraction.md"}, "properties": {"repobilityId": "d72d86c51e0a830d", "scanner": "scanner-primary", "fingerprint": "a09cda6cff76d6a4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/_distill/task-extraction.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-237e9c32432d9dc3", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/_retrospective/theme-extraction-agent.md"}, "properties": {"repobilityId": "5a5e8e378301ab34", "scanner": "scanner-primary", "fingerprint": "237e9c32432d9dc3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/_retrospective/theme-extraction-agent.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cf78b63fdb6a9966", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/templates/sub-agent-template.md"}, "properties": {"repobilityId": "ead788a4cccd3e33", "scanner": "scanner-primary", "fingerprint": "cf78b63fdb6a9966", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/templates/sub-agent-template.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-243e67fabcb77ba6", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: reports/daily/CLAUDE.md"}, "properties": {"repobilityId": "519d2a5ebab44f64", "scanner": "scanner-primary", "fingerprint": "243e67fabcb77ba6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "reports/daily/CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4dc27fdf9e0c1a83", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: reports/newsletter/CLAUDE.md"}, "properties": {"repobilityId": "b04d9d54218ba464", "scanner": "scanner-primary", "fingerprint": "4dc27fdf9e0c1a83", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "reports/newsletter/CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4cd33eccb3022086", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/clip-tweet/SKILL.md"}, "properties": {"repobilityId": "1eb9b58fe59c601b", "scanner": "scanner-primary", "fingerprint": "4cd33eccb3022086", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/clip-tweet/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1f477407c38a1b38", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/pulse/SKILL.md"}, "properties": {"repobilityId": "d4a8a215cb89feeb", "scanner": "scanner-primary", "fingerprint": "1f477407c38a1b38", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/pulse/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3cab8e0b89a932e4", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/focus/SKILL.md"}, "properties": {"repobilityId": "2375a7a0b4acaf2b", "scanner": "scanner-primary", "fingerprint": "3cab8e0b89a932e4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/focus/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fcc69bc446b5cc5e", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/maintain/SKILL.md"}, "properties": {"repobilityId": "6b40f8302cf05a66", "scanner": "scanner-primary", "fingerprint": "fcc69bc446b5cc5e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/maintain/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9234af3688069f90", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/morning/SKILL.md"}, "properties": {"repobilityId": "cf75904dc2b04cbd", "scanner": "scanner-primary", "fingerprint": "9234af3688069f90", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/morning/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-01c804260b4de20f", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/briefing/SKILL.md"}, "properties": {"repobilityId": "8c7fb55de809dd18", "scanner": "scanner-primary", "fingerprint": "01c804260b4de20f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/briefing/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-83b558dee0414578", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: inbox/CLAUDE.md"}, "properties": {"repobilityId": "162835ed24b75afd", "scanner": "scanner-primary", "fingerprint": "83b558dee0414578", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "inbox/CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d0b11f348377cd49", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: inbox/journal/CLAUDE.md"}, "properties": {"repobilityId": "581e612efa444111", "scanner": "scanner-primary", "fingerprint": "d0b11f348377cd49", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "inbox/journal/CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-689e776d5b97389c", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: knowledge/orgs/CLAUDE.md"}, "properties": {"repobilityId": "6f5b930fe17841e5", "scanner": "scanner-primary", "fingerprint": "689e776d5b97389c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "knowledge/orgs/CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7de8e8d929e214d4", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: knowledge/people/CLAUDE.md"}, "properties": {"repobilityId": "a1b3a14b89c4500e", "scanner": "scanner-primary", "fingerprint": "7de8e8d929e214d4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "knowledge/people/CLAUDE.md"}, "region": {"startLine": 1}}}]}]}]}