{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-ae4973ff9375d71a", "name": "Possibly dead Python function: sha256_bytes", "shortDescription": {"text": "Possibly dead Python function: sha256_bytes"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-485473f836649a9a", "name": "Possibly dead Python function: repl", "shortDescription": {"text": "Possibly dead Python function: repl"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f96d9b7981c2e5fa", "name": "Possibly dead Python function: bake_tree", "shortDescription": {"text": "Possibly dead Python function: bake_tree"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bead75b0f9233e05", "name": "No API endpoints detected", "shortDescription": {"text": "No API endpoints detected"}, "fullDescription": {"text": "The scanner did not find FastAPI/Flask/Express/NestJS/GraphQL/gRPC routes. If this repo exposes APIs, the framework may be unsupported."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6f1d3923af8d0a52", "name": "Stray `console.log` in TS/JS \u2014 hardened/quartz/quartz/build.ts:62", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 hardened/quartz/quartz/build.ts:62"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5448320b9a4b3c67", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 hardened/quartz/quartz/plugins/emitters/memexDashboards.ts:535", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 hardened/quartz/quartz/plugins/emitters/memexDashboards.ts:535"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-015bea6edcb41828", "name": "Stray `console.log` in TS/JS \u2014 hardened/quartz/quartz/plugins/emitters/contentPage.tsx:92", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 hardened/quartz/quartz/plugins/emitters/contentPage.tsx:92"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-11cacc8fbafb03aa", "name": "Stray `console.log` in TS/JS \u2014 hardened/quartz/quartz/plugins/transformers/lastmod.ts:29", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 hardened/quartz/quartz/plugins/transformers/lastmod.ts:29"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3675c890c044fb98", "name": "Stray `console.log` in TS/JS \u2014 hardened/quartz/quartz/util/og.tsx:102", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 hardened/quartz/quartz/util/og.tsx:102"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-081cb3ccb7288953", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 hardened/quartz/quartz/util/resources.tsx:41", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 hardened/quartz/quartz/util/resources.tsx:41"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5d4194da2bf106dc", "name": "Stray `console.log` in TS/JS \u2014 hardened/quartz/quartz/util/log.ts:22", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 hardened/quartz/quartz/util/log.ts:22"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ec9548ff9fe74ede", "name": "Stray `console.log` in TS/JS \u2014 hardened/quartz/quartz/processors/filter.ts:15", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 hardened/quartz/quartz/processors/filter.ts:15"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fbd8ccb583f22bba", "name": "Stray `console.log` in TS/JS \u2014 hardened/quartz/quartz/processors/parse.ts:112", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 hardened/quartz/quartz/processors/parse.ts:112"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-575c8e562991e0c7", "name": "Stray `console.log` in TS/JS \u2014 hardened/quartz/quartz/processors/emit.ts:27", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 hardened/quartz/quartz/processors/emit.ts:27"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-88a2ffc12d5f004f", "name": "Stray `console.log` in TS/JS \u2014 hardened/quartz/quartz/cli/handlers.js:50", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 hardened/quartz/quartz/cli/handlers.js:50"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5be83d8f040f7aa2", "name": "Dockerfile runs as root: hardened/quartz/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: hardened/quartz/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-beaf8d4b98f007fb", "name": "Docker base image is tag-pinned but not digest-pinned: node:22-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2de59354cae0cd65", "name": "Insecure pattern 'direct_innerhtml_assignment' in hardened/quartz/quartz/plugins/emitters/componentResources.ts:162", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in hardened/quartz/quartz/plugins/emitters/componentResources.ts:162"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-14403df2e3c3aca4", "name": "Insecure pattern 'dangerous_innerhtml' in hardened/quartz/quartz/util/resources.tsx:41", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in hardened/quartz/quartz/util/resources.tsx:41"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8281dfe0817e6fbb", "name": "Insecure pattern 'direct_innerhtml_assignment' in hardened/quartz/quartz/components/MemexDashboard.tsx:356", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in hardened/quartz/quartz/components/MemexDashboard.tsx:356"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-84e644b69fb6a0b2", "name": "Insecure pattern 'domparser_html_parse' in hardened/quartz/quartz/components/scripts/spa.inline.ts:88", "shortDescription": {"text": "Insecure pattern 'domparser_html_parse' in hardened/quartz/quartz/components/scripts/spa.inline.ts:88"}, "fullDescription": {"text": "Found a known-risky pattern (domparser_html_parse). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-56cecd2a610931a1", "name": "Insecure pattern 'direct_innerhtml_assignment' in hardened/quartz/quartz/components/scripts/search.inline.ts:347", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in hardened/quartz/quartz/components/scripts/search.inline.ts:347"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4667b5ade023a6ad", "name": "Insecure pattern 'domparser_html_parse' in hardened/quartz/quartz/components/scripts/search.inline.ts:152", "shortDescription": {"text": "Insecure pattern 'domparser_html_parse' in hardened/quartz/quartz/components/scripts/search.inline.ts:152"}, "fullDescription": {"text": "Found a known-risky pattern (domparser_html_parse). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7988e1851a95e4c2", "name": "Insecure pattern 'direct_innerhtml_assignment' in hardened/quartz/quartz/components/scripts/clipboard.inline.ts:17", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in hardened/quartz/quartz/components/scripts/clipboard.inline.ts:17"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9a9609934f5b1d95", "name": "Insecure pattern 'direct_innerhtml_assignment' in hardened/quartz/quartz/components/scripts/mermaid.inline.ts:210", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in hardened/quartz/quartz/components/scripts/mermaid.inline.ts:210"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-344b383f9bf60a9b", "name": "Insecure pattern 'domparser_html_parse' in hardened/quartz/quartz/components/scripts/popover.inline.ts:92", "shortDescription": {"text": "Insecure pattern 'domparser_html_parse' in hardened/quartz/quartz/components/scripts/popover.inline.ts:92"}, "fullDescription": {"text": "Found a known-risky pattern (domparser_html_parse). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4ccc3420b5333ce4", "name": "Insecure pattern 'new_function_used' in hardened/quartz/quartz/components/scripts/explorer.inline.ts:167", "shortDescription": {"text": "Insecure pattern 'new_function_used' in hardened/quartz/quartz/components/scripts/explorer.inline.ts:167"}, "fullDescription": {"text": "Found a known-risky pattern (new_function_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9b50bcb56fbefc09", "name": "Insecure pattern 'node_child_process' in hardened/quartz/quartz/cli/helpers.js:4", "shortDescription": {"text": "Insecure pattern 'node_child_process' in hardened/quartz/quartz/cli/helpers.js:4"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ab1408ed2f936398", "name": "Insecure pattern 'node_child_process' in hardened/quartz/quartz/cli/handlers.js:11", "shortDescription": {"text": "Insecure pattern 'node_child_process' in hardened/quartz/quartz/cli/handlers.js:11"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-65e813d11658e4e3", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8cdb0dba4cd973da", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e79b8621e97d13c9", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/download-artifact@v7 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7424b7830acd847c", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "rlespinasse/github-slug-action@v5.4.0 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5531e0844d674fa1", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2aa43b864dd2c153", "name": "Very large file: tools/memex_update.py (1381 lines)", "shortDescription": {"text": "Very large file: tools/memex_update.py (1381 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "6 test file(s) for 157 source file(s) (ratio 0.04). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2fbe176a90ede8a4", "name": "33 TODO/FIXME markers", "shortDescription": {"text": "33 TODO/FIXME markers"}, "fullDescription": {"text": "High count of TODO/FIXME/HACK markers \u2014 track them as issues so they're not forgotten."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 119 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 33 placeholder/mock markers across 9 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cd52bbeaf3038045", "name": "Agent authority lacks a verifier contract: packs/pi/skills/cv-build/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: packs/pi/skills/cv-build/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-32ebd9f7cf093bb3", "name": "Agent authority lacks a verifier contract: packs/core/skills/revisit-decisions/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: packs/core/skills/revisit-decisions/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-39f1cc4f00b1c370", "name": "Agent authority lacks a verifier contract: packs/core/skills/lint/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: packs/core/skills/lint/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f733a92bb40284c9", "name": "Agent authority lacks a verifier contract: packs/core/skills/daily-briefing/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: packs/core/skills/daily-briefing/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4bbc6775b7042f29", "name": "Agent authority lacks a verifier contract: packs/core/skills/ingest-source/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: packs/core/skills/ingest-source/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3c10e7bcd9783f00", "name": "Agent authority lacks a verifier contract: packs/core/skills/triage-inbox/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: packs/core/skills/triage-inbox/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fdf9f634fa76b75e", "name": "Agent authority lacks a verifier contract: packs/core/skills/session-start/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: packs/core/skills/session-start/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c605fe4602f56d09", "name": "Agent authority lacks a verifier contract: packs/core/skills/update/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: packs/core/skills/update/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d067970e2945a30f", "name": "Agent authority lacks a verifier contract: packs/core/skills/ingest-person/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: packs/core/skills/ingest-person/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e0c16a431dfff074", "name": "Agent authority lacks a verifier contract: packs/core/skills/shutdown-review/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: packs/core/skills/shutdown-review/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-90ce3399e7ae3d31", "name": "Agent authority lacks a verifier contract: packs/core/skills/run-trackers/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: packs/core/skills/run-trackers/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b565b2d4cc36ad90", "name": "Agent authority lacks a verifier contract: packs/core/skills/email/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: packs/core/skills/email/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9fb9e1e43cd6b373", "name": "Agent authority lacks a verifier contract: packs/core/skills/reconcile-from-comms/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: packs/core/skills/reconcile-from-comms/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-070434fa4f248510", "name": "Agent authority lacks a verifier contract: packs/core/skills/capture-comms/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: packs/core/skills/capture-comms/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a0c4e7d00966634a", "name": "Commented-code block (5 lines) in hardened/quartz/quartz.config.ts:59", "shortDescription": {"text": "Commented-code block (5 lines) in hardened/quartz/quartz.config.ts:59"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c2e01a14a9c0d30a", "name": "Commented-code block (8 lines) in hardened/quartz/quartz/build.ts:145", "shortDescription": {"text": "Commented-code block (8 lines) in hardened/quartz/quartz/build.ts:145"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ca4b23910f8eceb8", "name": "Commented-code block (6 lines) in hardened/quartz/quartz/plugins/emitters/memexDashboards.ts:3", "shortDescription": {"text": "Commented-code block (6 lines) in hardened/quartz/quartz/plugins/emitters/memexDashboards.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3230e6e4566aab41", "name": "`fetch()` without try/.catch or AbortSignal \u2014 hardened/quartz/quartz/plugins/emitters/componentResources.ts:283", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 hardened/quartz/quartz/plugins/emitters/componentResources.ts:283"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b48f035539973e5d", "name": "Commented-code block (5 lines) in hardened/quartz/quartz/plugins/filters/sensitivity.test.ts:33", "shortDescription": {"text": "Commented-code block (5 lines) in hardened/quartz/quartz/plugins/filters/sensitivity.test.ts:33"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-08bf35e540ae1c2c", "name": "Commented-code block (5 lines) in hardened/quartz/quartz/plugins/transformers/ofm.ts:114", "shortDescription": {"text": "Commented-code block (5 lines) in hardened/quartz/quartz/plugins/transformers/ofm.ts:114"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ac98487dcafda1e4", "name": "`fetch()` without try/.catch or AbortSignal \u2014 hardened/quartz/quartz/util/og.tsx:112", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 hardened/quartz/quartz/util/og.tsx:112"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-23bbdd8eb6066c04", "name": "Commented-code block (7 lines) in hardened/quartz/quartz/components/DashboardsNav.tsx:5", "shortDescription": {"text": "Commented-code block (7 lines) in hardened/quartz/quartz/components/DashboardsNav.tsx:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-28ec2d8133acbecb", "name": "Commented-code block (5 lines) in hardened/quartz/quartz/components/MemexDashboard.tsx:3", "shortDescription": {"text": "Commented-code block (5 lines) in hardened/quartz/quartz/components/MemexDashboard.tsx:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d446787c11ee4c10", "name": "`fetch()` without try/.catch or AbortSignal \u2014 hardened/quartz/quartz/components/renderPage.tsx:31", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 hardened/quartz/quartz/components/renderPage.tsx:31"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c63fa3b9a7bc2fec", "name": "`fetch()` without try/.catch or AbortSignal \u2014 hardened/quartz/quartz/components/scripts/search.inline.ts:405", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 hardened/quartz/quartz/components/scripts/search.inline.ts:405"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1a2413b635650417", "name": "Commented-code block (5 lines) in hardened/quartz/quartz/components/scripts/util.ts:28", "shortDescription": {"text": "Commented-code block (5 lines) in hardened/quartz/quartz/components/scripts/util.ts:28"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0e6849ac461f64b6", "name": "`fetch()` without try/.catch or AbortSignal \u2014 hardened/quartz/quartz/components/scripts/util.ts:36", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 hardened/quartz/quartz/components/scripts/util.ts:36"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cefab763f81a29a4", "name": "Commented-code block (7 lines) in tools/derive.py:33", "shortDescription": {"text": "Commented-code block (7 lines) in tools/derive.py:33"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8f1d2720e0301fe2", "name": "Legacy-named symbol `used_old` in tools/memex_update.py:507", "shortDescription": {"text": "Legacy-named symbol `used_old` in tools/memex_update.py:507"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ff14564f60e2b607", "name": "Commented-code block (6 lines) in tools/memex_update.py:1275", "shortDescription": {"text": "Commented-code block (6 lines) in tools/memex_update.py:1275"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-771c62c15b13f8a7", "name": "Network/subprocess call without timeout or try/except \u2014 tools/memex_update.py:383", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/memex_update.py:383"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-88b6614445f54ace", "name": "Commented-code block (5 lines) in tools/memex_bake.py:475", "shortDescription": {"text": "Commented-code block (5 lines) in tools/memex_bake.py:475"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/24304"}, "properties": {"repository": "arjunrajlaboratory/Memex", "repoUrl": "https://github.com/arjunrajlaboratory/Memex", "branch": "main"}, "results": [{"ruleId": "scanner-ae4973ff9375d71a", "level": "note", "message": {"text": "Possibly dead Python function: sha256_bytes"}, "properties": {"repobilityId": "d784c22216f22074", "scanner": "scanner-primary", "fingerprint": "ae4973ff9375d71a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/memex_bake.py:137"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-485473f836649a9a", "level": "note", "message": {"text": "Possibly dead Python function: repl"}, "properties": {"repobilityId": "6f5d3779bbb8be8b", "scanner": "scanner-primary", "fingerprint": "485473f836649a9a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/memex_bake.py:149"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f96d9b7981c2e5fa", "level": "note", "message": {"text": "Possibly dead Python function: bake_tree"}, "properties": {"repobilityId": "9bd6f4a245abb7b0", "scanner": "scanner-primary", "fingerprint": "f96d9b7981c2e5fa", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/memex_bake.py:184"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bead75b0f9233e05", "level": "none", "message": {"text": "No API endpoints detected"}, "properties": {"repobilityId": "0f8bb852027c38f8", "scanner": "scanner-primary", "fingerprint": "bead75b0f9233e05", "layer": "api", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-6f1d3923af8d0a52", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 hardened/quartz/quartz/build.ts:62"}, "properties": {"repobilityId": "36186fc81d69396e", "scanner": "scanner-primary", "fingerprint": "6f1d3923af8d0a52", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-5448320b9a4b3c67", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 hardened/quartz/quartz/plugins/emitters/memexDashboards.ts:535"}, "properties": {"repobilityId": "30eab163faf2e982", "scanner": "scanner-primary", "fingerprint": "5448320b9a4b3c67", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-015bea6edcb41828", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 hardened/quartz/quartz/plugins/emitters/contentPage.tsx:92"}, "properties": {"repobilityId": "34f85ac71db88634", "scanner": "scanner-primary", "fingerprint": "015bea6edcb41828", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-11cacc8fbafb03aa", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 hardened/quartz/quartz/plugins/transformers/lastmod.ts:29"}, "properties": {"repobilityId": "aa6c95bea95f4ba4", "scanner": "scanner-primary", "fingerprint": "11cacc8fbafb03aa", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-3675c890c044fb98", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 hardened/quartz/quartz/util/og.tsx:102"}, "properties": {"repobilityId": "e4d54b029060b974", "scanner": "scanner-primary", "fingerprint": "3675c890c044fb98", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-081cb3ccb7288953", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 hardened/quartz/quartz/util/resources.tsx:41"}, "properties": {"repobilityId": "79458a5ae779eec7", "scanner": "scanner-primary", "fingerprint": "081cb3ccb7288953", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-5d4194da2bf106dc", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 hardened/quartz/quartz/util/log.ts:22"}, "properties": {"repobilityId": "b873216434663933", "scanner": "scanner-primary", "fingerprint": "5d4194da2bf106dc", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ec9548ff9fe74ede", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 hardened/quartz/quartz/processors/filter.ts:15"}, "properties": {"repobilityId": "7e90579a18bba84f", "scanner": "scanner-primary", "fingerprint": "ec9548ff9fe74ede", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-fbd8ccb583f22bba", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 hardened/quartz/quartz/processors/parse.ts:112"}, "properties": {"repobilityId": "f67841c65a81252b", "scanner": "scanner-primary", "fingerprint": "fbd8ccb583f22bba", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-575c8e562991e0c7", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 hardened/quartz/quartz/processors/emit.ts:27"}, "properties": {"repobilityId": "1e981b2d2331908c", "scanner": "scanner-primary", "fingerprint": "575c8e562991e0c7", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-88a2ffc12d5f004f", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 hardened/quartz/quartz/cli/handlers.js:50"}, "properties": {"repobilityId": "7aa22ac3c20906d6", "scanner": "scanner-primary", "fingerprint": "88a2ffc12d5f004f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-5be83d8f040f7aa2", "level": "warning", "message": {"text": "Dockerfile runs as root: hardened/quartz/Dockerfile"}, "properties": {"repobilityId": "993c69b79dd99f4c", "scanner": "scanner-primary", "fingerprint": "5be83d8f040f7aa2", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-beaf8d4b98f007fb", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-slim"}, "properties": {"repobilityId": "5a60edd8f4d13f95", "scanner": "scanner-primary", "fingerprint": "beaf8d4b98f007fb", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hardened/quartz/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-beaf8d4b98f007fb", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-slim"}, "properties": {"repobilityId": "a439757dc202bf64", "scanner": "scanner-primary", "fingerprint": "beaf8d4b98f007fb", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hardened/quartz/Dockerfile"}, "region": {"startLine": 6}}}]}, {"ruleId": "scanner-2de59354cae0cd65", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in hardened/quartz/quartz/plugins/emitters/componentResources.ts:162"}, "properties": {"repobilityId": "71fb5b30dea8c54a", "scanner": "scanner-primary", "fingerprint": "2de59354cae0cd65", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hardened/quartz/quartz/plugins/emitters/componentResources.ts"}, "region": {"startLine": 162}}}]}, {"ruleId": "scanner-14403df2e3c3aca4", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in hardened/quartz/quartz/util/resources.tsx:41"}, "properties": {"repobilityId": "9c303b9a42dff7fd", "scanner": "scanner-primary", "fingerprint": "14403df2e3c3aca4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hardened/quartz/quartz/util/resources.tsx"}, "region": {"startLine": 41}}}]}, {"ruleId": "scanner-8281dfe0817e6fbb", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in hardened/quartz/quartz/components/MemexDashboard.tsx:356"}, "properties": {"repobilityId": "2f4bbd6aea36c9bb", "scanner": "scanner-primary", "fingerprint": "8281dfe0817e6fbb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hardened/quartz/quartz/components/MemexDashboard.tsx"}, "region": {"startLine": 356}}}]}, {"ruleId": "scanner-84e644b69fb6a0b2", "level": "warning", "message": {"text": "Insecure pattern 'domparser_html_parse' in hardened/quartz/quartz/components/scripts/spa.inline.ts:88"}, "properties": {"repobilityId": "2d4b13c1b1604867", "scanner": "scanner-primary", "fingerprint": "84e644b69fb6a0b2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "domparser_html_parse"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hardened/quartz/quartz/components/scripts/spa.inline.ts"}, "region": {"startLine": 88}}}]}, {"ruleId": "scanner-56cecd2a610931a1", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in hardened/quartz/quartz/components/scripts/search.inline.ts:347"}, "properties": {"repobilityId": "a5e7b5787e0cc9a1", "scanner": "scanner-primary", "fingerprint": "56cecd2a610931a1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hardened/quartz/quartz/components/scripts/search.inline.ts"}, "region": {"startLine": 347}}}]}, {"ruleId": "scanner-4667b5ade023a6ad", "level": "warning", "message": {"text": "Insecure pattern 'domparser_html_parse' in hardened/quartz/quartz/components/scripts/search.inline.ts:152"}, "properties": {"repobilityId": "7b8239556032c99c", "scanner": "scanner-primary", "fingerprint": "4667b5ade023a6ad", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "domparser_html_parse"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hardened/quartz/quartz/components/scripts/search.inline.ts"}, "region": {"startLine": 152}}}]}, {"ruleId": "scanner-7988e1851a95e4c2", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in hardened/quartz/quartz/components/scripts/clipboard.inline.ts:17"}, "properties": {"repobilityId": "5d0ae5f42738e469", "scanner": "scanner-primary", "fingerprint": "7988e1851a95e4c2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hardened/quartz/quartz/components/scripts/clipboard.inline.ts"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-9a9609934f5b1d95", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in hardened/quartz/quartz/components/scripts/mermaid.inline.ts:210"}, "properties": {"repobilityId": "abb69884622afd08", "scanner": "scanner-primary", "fingerprint": "9a9609934f5b1d95", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hardened/quartz/quartz/components/scripts/mermaid.inline.ts"}, "region": {"startLine": 210}}}]}, {"ruleId": "scanner-344b383f9bf60a9b", "level": "warning", "message": {"text": "Insecure pattern 'domparser_html_parse' in hardened/quartz/quartz/components/scripts/popover.inline.ts:92"}, "properties": {"repobilityId": "39c5585fc91e9c3b", "scanner": "scanner-primary", "fingerprint": "344b383f9bf60a9b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "domparser_html_parse"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hardened/quartz/quartz/components/scripts/popover.inline.ts"}, "region": {"startLine": 92}}}]}, {"ruleId": "scanner-4ccc3420b5333ce4", "level": "error", "message": {"text": "Insecure pattern 'new_function_used' in hardened/quartz/quartz/components/scripts/explorer.inline.ts:167"}, "properties": {"repobilityId": "75f593789f6c2fa9", "scanner": "scanner-primary", "fingerprint": "4ccc3420b5333ce4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "new_function_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hardened/quartz/quartz/components/scripts/explorer.inline.ts"}, "region": {"startLine": 167}}}]}, {"ruleId": "scanner-9b50bcb56fbefc09", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in hardened/quartz/quartz/cli/helpers.js:4"}, "properties": {"repobilityId": "aba38c47990f016f", "scanner": "scanner-primary", "fingerprint": "9b50bcb56fbefc09", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hardened/quartz/quartz/cli/helpers.js"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-ab1408ed2f936398", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in hardened/quartz/quartz/cli/handlers.js:11"}, "properties": {"repobilityId": "ff5951d51c760970", "scanner": "scanner-primary", "fingerprint": "ab1408ed2f936398", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hardened/quartz/quartz/cli/handlers.js"}, "region": {"startLine": 11}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-65e813d11658e4e3", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "eea9545bb16d656a", "scanner": "scanner-primary", "fingerprint": "65e813d11658e4e3", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hardened/quartz/.github/workflows/ci.yaml"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-65e813d11658e4e3", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4ad52ac263908bd5", "scanner": "scanner-primary", "fingerprint": "65e813d11658e4e3", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hardened/quartz/.github/workflows/ci.yaml"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-65e813d11658e4e3", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "eea9545bb16d656a", "scanner": "scanner-primary", "fingerprint": "65e813d11658e4e3", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hardened/quartz/.github/workflows/ci.yaml"}, "region": {"startLine": 60}}}]}, {"ruleId": "scanner-65e813d11658e4e3", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "08a3be88cbefc3cd", "scanner": "scanner-primary", "fingerprint": "65e813d11658e4e3", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hardened/quartz/.github/workflows/ci.yaml"}, "region": {"startLine": 66}}}]}, {"ruleId": "scanner-8cdb0dba4cd973da", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "a4b157ceb7a30db5", "scanner": "scanner-primary", "fingerprint": "8cdb0dba4cd973da", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hardened/quartz/.github/workflows/ci.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e79b8621e97d13c9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "14532842ccfd357e", "scanner": "scanner-primary", "fingerprint": "e79b8621e97d13c9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hardened/quartz/.github/workflows/deploy-preview.yaml"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-e79b8621e97d13c9", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e6e62dd46b6812ad", "scanner": "scanner-primary", "fingerprint": "e79b8621e97d13c9", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hardened/quartz/.github/workflows/deploy-preview.yaml"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-7424b7830acd847c", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e27c3e6958c893cf", "scanner": "scanner-primary", "fingerprint": "7424b7830acd847c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hardened/quartz/.github/workflows/docker-build-push.yaml"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-7424b7830acd847c", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "417a43b04e16d555", "scanner": "scanner-primary", "fingerprint": "7424b7830acd847c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hardened/quartz/.github/workflows/docker-build-push.yaml"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-7424b7830acd847c", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4171c7564ae18c46", "scanner": "scanner-primary", "fingerprint": "7424b7830acd847c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hardened/quartz/.github/workflows/docker-build-push.yaml"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-7424b7830acd847c", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f64966a661661964", "scanner": "scanner-primary", "fingerprint": "7424b7830acd847c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hardened/quartz/.github/workflows/docker-build-push.yaml"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-7424b7830acd847c", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cd7ec5f379086405", "scanner": "scanner-primary", "fingerprint": "7424b7830acd847c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hardened/quartz/.github/workflows/docker-build-push.yaml"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-7424b7830acd847c", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "47975448aef61ed0", "scanner": "scanner-primary", "fingerprint": "7424b7830acd847c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hardened/quartz/.github/workflows/docker-build-push.yaml"}, "region": {"startLine": 52}}}]}, {"ruleId": "scanner-7424b7830acd847c", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "47975448aef61ed0", "scanner": "scanner-primary", "fingerprint": "7424b7830acd847c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hardened/quartz/.github/workflows/docker-build-push.yaml"}, "region": {"startLine": 62}}}]}, {"ruleId": "scanner-7424b7830acd847c", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "74a765f8d7005c27", "scanner": "scanner-primary", "fingerprint": "7424b7830acd847c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hardened/quartz/.github/workflows/docker-build-push.yaml"}, "region": {"startLine": 79}}}]}, {"ruleId": "scanner-5531e0844d674fa1", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "943f601a8ec07577", "scanner": "scanner-primary", "fingerprint": "5531e0844d674fa1", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hardened/quartz/.github/workflows/build-preview.yaml"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-5531e0844d674fa1", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "01c47f37e1723273", "scanner": "scanner-primary", "fingerprint": "5531e0844d674fa1", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hardened/quartz/.github/workflows/build-preview.yaml"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-5531e0844d674fa1", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "40a1b3153a455b13", "scanner": "scanner-primary", "fingerprint": "5531e0844d674fa1", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "hardened/quartz/.github/workflows/build-preview.yaml"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-2aa43b864dd2c153", "level": "note", "message": {"text": "Very large file: tools/memex_update.py (1381 lines)"}, "properties": {"repobilityId": "595999d924662f20", "scanner": "scanner-primary", "fingerprint": "2aa43b864dd2c153", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-2fbe176a90ede8a4", "level": "note", "message": {"text": "33 TODO/FIXME markers"}, "properties": {"repobilityId": "4b38c118003e07d2", "scanner": "scanner-primary", "fingerprint": "2fbe176a90ede8a4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["maintenance"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "5f4a730984e8b153", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "529258c496c8196b", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "83066d78ff4dacc5", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-cd52bbeaf3038045", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: packs/pi/skills/cv-build/SKILL.md"}, "properties": {"repobilityId": "85e44a40329e2ac7", "scanner": "scanner-primary", "fingerprint": "cd52bbeaf3038045", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packs/pi/skills/cv-build/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-32ebd9f7cf093bb3", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: packs/core/skills/revisit-decisions/SKILL.md"}, "properties": {"repobilityId": "83353e768cec2230", "scanner": "scanner-primary", "fingerprint": "32ebd9f7cf093bb3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packs/core/skills/revisit-decisions/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-39f1cc4f00b1c370", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: packs/core/skills/lint/SKILL.md"}, "properties": {"repobilityId": "626cdb50cfa1c912", "scanner": "scanner-primary", "fingerprint": "39f1cc4f00b1c370", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packs/core/skills/lint/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f733a92bb40284c9", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: packs/core/skills/daily-briefing/SKILL.md"}, "properties": {"repobilityId": "556aabd6542107eb", "scanner": "scanner-primary", "fingerprint": "f733a92bb40284c9", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packs/core/skills/daily-briefing/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4bbc6775b7042f29", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: packs/core/skills/ingest-source/SKILL.md"}, "properties": {"repobilityId": "1a030ee739606d6f", "scanner": "scanner-primary", "fingerprint": "4bbc6775b7042f29", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packs/core/skills/ingest-source/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3c10e7bcd9783f00", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: packs/core/skills/triage-inbox/SKILL.md"}, "properties": {"repobilityId": "dc4b91f2c4adac02", "scanner": "scanner-primary", "fingerprint": "3c10e7bcd9783f00", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packs/core/skills/triage-inbox/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fdf9f634fa76b75e", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: packs/core/skills/session-start/SKILL.md"}, "properties": {"repobilityId": "227a6d650301d97b", "scanner": "scanner-primary", "fingerprint": "fdf9f634fa76b75e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packs/core/skills/session-start/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c605fe4602f56d09", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: packs/core/skills/update/SKILL.md"}, "properties": {"repobilityId": "0b01d45a94622642", "scanner": "scanner-primary", "fingerprint": "c605fe4602f56d09", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packs/core/skills/update/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d067970e2945a30f", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: packs/core/skills/ingest-person/SKILL.md"}, "properties": {"repobilityId": "66e331a5a3db0f14", "scanner": "scanner-primary", "fingerprint": "d067970e2945a30f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packs/core/skills/ingest-person/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e0c16a431dfff074", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: packs/core/skills/shutdown-review/SKILL.md"}, "properties": {"repobilityId": "de185680ef417e02", "scanner": "scanner-primary", "fingerprint": "e0c16a431dfff074", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packs/core/skills/shutdown-review/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-90ce3399e7ae3d31", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: packs/core/skills/run-trackers/SKILL.md"}, "properties": {"repobilityId": "c8ee1bf9f160b2cd", "scanner": "scanner-primary", "fingerprint": "90ce3399e7ae3d31", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packs/core/skills/run-trackers/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b565b2d4cc36ad90", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: packs/core/skills/email/SKILL.md"}, "properties": {"repobilityId": "c877999ca3cab221", "scanner": "scanner-primary", "fingerprint": "b565b2d4cc36ad90", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packs/core/skills/email/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9fb9e1e43cd6b373", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: packs/core/skills/reconcile-from-comms/SKILL.md"}, "properties": {"repobilityId": "d1151cd56164be71", "scanner": "scanner-primary", "fingerprint": "9fb9e1e43cd6b373", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packs/core/skills/reconcile-from-comms/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-070434fa4f248510", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: packs/core/skills/capture-comms/SKILL.md"}, "properties": {"repobilityId": "c960743259217c62", "scanner": "scanner-primary", "fingerprint": "070434fa4f248510", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packs/core/skills/capture-comms/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a0c4e7d00966634a", "level": "none", "message": {"text": "Commented-code block (5 lines) in hardened/quartz/quartz.config.ts:59"}, "properties": {"repobilityId": "0beaae542a50062d", "scanner": "scanner-primary", "fingerprint": "a0c4e7d00966634a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c2e01a14a9c0d30a", "level": "none", "message": {"text": "Commented-code block (8 lines) in hardened/quartz/quartz/build.ts:145"}, "properties": {"repobilityId": "f6e7cf316f14ef78", "scanner": "scanner-primary", "fingerprint": "c2e01a14a9c0d30a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ca4b23910f8eceb8", "level": "none", "message": {"text": "Commented-code block (6 lines) in hardened/quartz/quartz/plugins/emitters/memexDashboards.ts:3"}, "properties": {"repobilityId": "3d89508b2d023d1d", "scanner": "scanner-primary", "fingerprint": "ca4b23910f8eceb8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3230e6e4566aab41", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 hardened/quartz/quartz/plugins/emitters/componentResources.ts:283"}, "properties": {"repobilityId": "fd9c5e1de6519557", "scanner": "scanner-primary", "fingerprint": "3230e6e4566aab41", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b48f035539973e5d", "level": "none", "message": {"text": "Commented-code block (5 lines) in hardened/quartz/quartz/plugins/filters/sensitivity.test.ts:33"}, "properties": {"repobilityId": "6f35af3b203b494b", "scanner": "scanner-primary", "fingerprint": "b48f035539973e5d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-08bf35e540ae1c2c", "level": "none", "message": {"text": "Commented-code block (5 lines) in hardened/quartz/quartz/plugins/transformers/ofm.ts:114"}, "properties": {"repobilityId": "bc0bf3d0febda5b0", "scanner": "scanner-primary", "fingerprint": "08bf35e540ae1c2c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ac98487dcafda1e4", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 hardened/quartz/quartz/util/og.tsx:112"}, "properties": {"repobilityId": "9d42a71fe937b1a7", "scanner": "scanner-primary", "fingerprint": "ac98487dcafda1e4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-23bbdd8eb6066c04", "level": "none", "message": {"text": "Commented-code block (7 lines) in hardened/quartz/quartz/components/DashboardsNav.tsx:5"}, "properties": {"repobilityId": "2b69fbc461ebe4e8", "scanner": "scanner-primary", "fingerprint": "23bbdd8eb6066c04", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-28ec2d8133acbecb", "level": "none", "message": {"text": "Commented-code block (5 lines) in hardened/quartz/quartz/components/MemexDashboard.tsx:3"}, "properties": {"repobilityId": "850a8547a00bfa32", "scanner": "scanner-primary", "fingerprint": "28ec2d8133acbecb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d446787c11ee4c10", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 hardened/quartz/quartz/components/renderPage.tsx:31"}, "properties": {"repobilityId": "76ff77dee0dc0b33", "scanner": "scanner-primary", "fingerprint": "d446787c11ee4c10", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-c63fa3b9a7bc2fec", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 hardened/quartz/quartz/components/scripts/search.inline.ts:405"}, "properties": {"repobilityId": "14d244c514e53068", "scanner": "scanner-primary", "fingerprint": "c63fa3b9a7bc2fec", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-1a2413b635650417", "level": "none", "message": {"text": "Commented-code block (5 lines) in hardened/quartz/quartz/components/scripts/util.ts:28"}, "properties": {"repobilityId": "24da7f7fb80380fa", "scanner": "scanner-primary", "fingerprint": "1a2413b635650417", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0e6849ac461f64b6", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 hardened/quartz/quartz/components/scripts/util.ts:36"}, "properties": {"repobilityId": "ee4e0ab95c16903c", "scanner": "scanner-primary", "fingerprint": "0e6849ac461f64b6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-cefab763f81a29a4", "level": "none", "message": {"text": "Commented-code block (7 lines) in tools/derive.py:33"}, "properties": {"repobilityId": "5103f5f785df8bc1", "scanner": "scanner-primary", "fingerprint": "cefab763f81a29a4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8f1d2720e0301fe2", "level": "note", "message": {"text": "Legacy-named symbol `used_old` in tools/memex_update.py:507"}, "properties": {"repobilityId": "2ad92a9365d24658", "scanner": "scanner-primary", "fingerprint": "8f1d2720e0301fe2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-ff14564f60e2b607", "level": "none", "message": {"text": "Commented-code block (6 lines) in tools/memex_update.py:1275"}, "properties": {"repobilityId": "9c87dcc5024077a4", "scanner": "scanner-primary", "fingerprint": "ff14564f60e2b607", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-771c62c15b13f8a7", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/memex_update.py:383"}, "properties": {"repobilityId": "fe25ad33027f32af", "scanner": "scanner-primary", "fingerprint": "771c62c15b13f8a7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-88b6614445f54ace", "level": "none", "message": {"text": "Commented-code block (5 lines) in tools/memex_bake.py:475"}, "properties": {"repobilityId": "6df398d95fd896bc", "scanner": "scanner-primary", "fingerprint": "88b6614445f54ace", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}]}]}