{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-46943be4aa6dd66f", "name": "Possibly dead Python function: transform_context_block", "shortDescription": {"text": "Possibly dead Python function: transform_context_block"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c54c9c43749e8fa4", "name": "Possibly dead Python function: phase3", "shortDescription": {"text": "Possibly dead Python function: phase3"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-87a6b75404e717ff", "name": "Possibly dead Python function: key", "shortDescription": {"text": "Possibly dead Python function: key"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e8ee572bb495369b", "name": "Possibly dead Python function: phase3", "shortDescription": {"text": "Possibly dead Python function: phase3"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fffccfde16d4e54a", "name": "Possibly dead Python function: key", "shortDescription": {"text": "Possibly dead Python function: key"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fdb1d26d8a7492f0", "name": "Possibly dead Python function: phase3", "shortDescription": {"text": "Possibly dead Python function: phase3"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-66e2cce5de387259", "name": "Possibly dead Python function: key", "shortDescription": {"text": "Possibly dead Python function: key"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5f8ff8c96eafd6df", "name": "Possibly dead Python function: phase3", "shortDescription": {"text": "Possibly dead Python function: phase3"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4b1b4567df735625", "name": "Possibly dead Python function: key", "shortDescription": {"text": "Possibly dead Python function: key"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd5ef7b6ab6a4873", "name": "TODO/FIXME marker in shipping code \u2014 openclaw-plugin/index.ts:521", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 openclaw-plugin/index.ts:521"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8f4c232b4aa78fc9", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-77166cbd46fcd8e4", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-27924aa79fa4a517", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "astral-sh/setup-uv@v7 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-de53ac274e5b4ecf", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-37716d9c0a33ad5c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-46c644c6227e4d4a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "astral-sh/setup-uv@v7 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e4f658c0c00de0d4", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/deploy-pages@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-448d8837178ae57a", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7d0807b4438e0f95", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-112fcf1f427a62b0", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0ff2e0753e6f5ce0", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9e92c031b633605d", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b753d02707481826", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f89605f572e78f82", "name": "Very large file: tests/test_install.py (2158 lines)", "shortDescription": {"text": "Very large file: tests/test_install.py (2158 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7d73ea022e2c5698", "name": "Very large file: openclaw-plugin/goc/install.py (1724 lines)", "shortDescription": {"text": "Very large file: openclaw-plugin/goc/install.py (1724 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3cd07d8aa91ba94e", "name": "Very large file: openclaw-plugin/goc/engine.py (5511 lines)", "shortDescription": {"text": "Very large file: openclaw-plugin/goc/engine.py (5511 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ab429f17e9263bd9", "name": "Very large file: codex-plugin/goc/install.py (1724 lines)", "shortDescription": {"text": "Very large file: codex-plugin/goc/install.py (1724 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-35af01d3096f25e8", "name": "Very large file: codex-plugin/goc/engine.py (5511 lines)", "shortDescription": {"text": "Very large file: codex-plugin/goc/engine.py (5511 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-617e4434211ab474", "name": "Very large file: goc/install.py (1724 lines)", "shortDescription": {"text": "Very large file: goc/install.py (1724 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5b21c320bea24aab", "name": "Very large file: goc/engine.py (5511 lines)", "shortDescription": {"text": "Very large file: goc/engine.py (5511 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b251e58976c1bad6", "name": "Very large file: claude-plugin/goc/install.py (1724 lines)", "shortDescription": {"text": "Very large file: claude-plugin/goc/install.py (1724 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-84fe966a6c768ba2", "name": "Very large file: claude-plugin/goc/engine.py (5511 lines)", "shortDescription": {"text": "Very large file: claude-plugin/goc/engine.py (5511 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 1095 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f3e9f8d58705a596", "name": "Agent authority lacks a verifier contract: openclaw-plugin/skills/openclaw-kickoff/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: openclaw-plugin/skills/openclaw-kickoff/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7957e8ac68218a23", "name": "Agent instruction contains unpinned remote install: openclaw-plugin/skills/openclaw-kickoff/SKILL.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: openclaw-plugin/skills/openclaw-kickoff/SKILL.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a4088afb1849d328", "name": "Agent authority lacks a verifier contract: openclaw-plugin/skills/retrospective/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: openclaw-plugin/skills/retrospective/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-122f91b7f2906dc4", "name": "Agent authority lacks a verifier contract: .claude/settings.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-445a1deaaa0a0d3f", "name": "Agent authority lacks a verifier contract: .claude/skills/retrospective/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/retrospective/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fd1434542600abaa", "name": "Agent authority lacks a verifier contract: goc/templates/skills/openclaw-kickoff/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: goc/templates/skills/openclaw-kickoff/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-303cdb4861d34c7d", "name": "Agent instruction contains unpinned remote install: goc/templates/skills/openclaw-kickoff/SKILL.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: goc/templates/skills/openclaw-kickoff/SKILL.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6b462f38c949ac4f", "name": "Agent authority lacks a verifier contract: goc/templates/skills/retrospective/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: goc/templates/skills/retrospective/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e07d5c766fe5895b", "name": "Agent authority lacks a verifier contract: claude-plugin/skills/retrospective/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: claude-plugin/skills/retrospective/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-de414546e17c9f41", "name": "Commented-code block (8 lines) in tests/test_repair_edges.py:154", "shortDescription": {"text": "Commented-code block (8 lines) in tests/test_repair_edges.py:154"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-dc26557f0bca4728", "name": "Commented-code block (7 lines) in scripts/sync_plugin_assets.py:310", "shortDescription": {"text": "Commented-code block (7 lines) in scripts/sync_plugin_assets.py:310"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d7acf3b78550f4fa", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/sync_plugin_assets.py:575", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/sync_plugin_assets.py:575"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a7eae9a606201d02", "name": "Commented-code block (5 lines) in scripts/port_skills_to_openclaw.py:40", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/port_skills_to_openclaw.py:40"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fc85984aef0a7a6a", "name": "Commented-code block (5 lines) in scripts/release_rewrite_versions.py:127", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/release_rewrite_versions.py:127"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ba350e8b6ba49477", "name": "Commented-code block (6 lines) in openclaw-plugin/index.ts:135", "shortDescription": {"text": "Commented-code block (6 lines) in openclaw-plugin/index.ts:135"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8afa2e32cb8b16ae", "name": "Legacy-named symbol `_ensure_backup` in openclaw-plugin/goc/install.py:567", "shortDescription": {"text": "Legacy-named symbol `_ensure_backup` in openclaw-plugin/goc/install.py:567"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-97a10a878cc62952", "name": "Commented-code block (5 lines) in openclaw-plugin/goc/install.py:689", "shortDescription": {"text": "Commented-code block (5 lines) in openclaw-plugin/goc/install.py:689"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-584779da84d40b0c", "name": "Legacy-named symbol `to_copy` in openclaw-plugin/goc/engine.py:5396", "shortDescription": {"text": "Legacy-named symbol `to_copy` in openclaw-plugin/goc/engine.py:5396"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-87366fe110ee22fa", "name": "Commented-code block (5 lines) in openclaw-plugin/goc/engine.py:181", "shortDescription": {"text": "Commented-code block (5 lines) in openclaw-plugin/goc/engine.py:181"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cba12eb4ec37b007", "name": "Network/subprocess call without timeout or try/except \u2014 openclaw-plugin/goc/engine.py:3488", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 openclaw-plugin/goc/engine.py:3488"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d95b7d0a1fc5077", "name": "Commented-code block (9 lines) in openclaw-plugin/goc/_vendor/yaml_lite.py:198", "shortDescription": {"text": "Commented-code block (9 lines) in openclaw-plugin/goc/_vendor/yaml_lite.py:198"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ed4d09f367dc57c3", "name": "Legacy-named symbol `_ensure_backup` in codex-plugin/goc/install.py:567", "shortDescription": {"text": "Legacy-named symbol `_ensure_backup` in codex-plugin/goc/install.py:567"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-54ac070aa61a900d", "name": "Commented-code block (5 lines) in codex-plugin/goc/install.py:689", "shortDescription": {"text": "Commented-code block (5 lines) in codex-plugin/goc/install.py:689"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a88478664f008557", "name": "Legacy-named symbol `to_copy` in codex-plugin/goc/engine.py:5396", "shortDescription": {"text": "Legacy-named symbol `to_copy` in codex-plugin/goc/engine.py:5396"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dc03be94767c43b2", "name": "Commented-code block (5 lines) in codex-plugin/goc/engine.py:181", "shortDescription": {"text": "Commented-code block (5 lines) in codex-plugin/goc/engine.py:181"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a7e521a29f7a609e", "name": "Network/subprocess call without timeout or try/except \u2014 codex-plugin/goc/engine.py:3488", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 codex-plugin/goc/engine.py:3488"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-24bc15dc6e59978e", "name": "Commented-code block (9 lines) in codex-plugin/goc/_vendor/yaml_lite.py:198", "shortDescription": {"text": "Commented-code block (9 lines) in codex-plugin/goc/_vendor/yaml_lite.py:198"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-875afb8818d10248", "name": "Legacy-named symbol `_ensure_backup` in goc/install.py:567", "shortDescription": {"text": "Legacy-named symbol `_ensure_backup` in goc/install.py:567"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8ac853e59254f532", "name": "Commented-code block (5 lines) in goc/install.py:689", "shortDescription": {"text": "Commented-code block (5 lines) in goc/install.py:689"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ac92b320386becba", "name": "Legacy-named symbol `to_copy` in goc/engine.py:5396", "shortDescription": {"text": "Legacy-named symbol `to_copy` in goc/engine.py:5396"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5bcf0a041ccfd779", "name": "Commented-code block (5 lines) in goc/engine.py:181", "shortDescription": {"text": "Commented-code block (5 lines) in goc/engine.py:181"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1e3124b61f2e41ee", "name": "Network/subprocess call without timeout or try/except \u2014 goc/engine.py:3488", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 goc/engine.py:3488"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-628d8d1a79614759", "name": "Commented-code block (9 lines) in goc/_vendor/yaml_lite.py:198", "shortDescription": {"text": "Commented-code block (9 lines) in goc/_vendor/yaml_lite.py:198"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-028663a7875e0dc4", "name": "Legacy-named symbol `_ensure_backup` in claude-plugin/goc/install.py:567", "shortDescription": {"text": "Legacy-named symbol `_ensure_backup` in claude-plugin/goc/install.py:567"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-16d50ae11ef6cbd3", "name": "Commented-code block (5 lines) in claude-plugin/goc/install.py:689", "shortDescription": {"text": "Commented-code block (5 lines) in claude-plugin/goc/install.py:689"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f1fb25095683938a", "name": "Legacy-named symbol `to_copy` in claude-plugin/goc/engine.py:5396", "shortDescription": {"text": "Legacy-named symbol `to_copy` in claude-plugin/goc/engine.py:5396"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4c82f9af529fca04", "name": "Commented-code block (5 lines) in claude-plugin/goc/engine.py:181", "shortDescription": {"text": "Commented-code block (5 lines) in claude-plugin/goc/engine.py:181"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a5765cab0d97c3a7", "name": "Network/subprocess call without timeout or try/except \u2014 claude-plugin/goc/engine.py:3488", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 claude-plugin/goc/engine.py:3488"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0cf487c7887cfaba", "name": "Commented-code block (9 lines) in claude-plugin/goc/_vendor/yaml_lite.py:198", "shortDescription": {"text": "Commented-code block (9 lines) in claude-plugin/goc/_vendor/yaml_lite.py:198"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-49c98f7cedd9c977", "name": "Near-duplicate function bodies in 4 places", "shortDescription": {"text": "Near-duplicate function bodies in 4 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nopenclaw-plugin/goc/install.py:deck_hook_scripts, codex-plugin/goc/install.py:deck_hook_scripts, goc/install.py:deck_hook_scripts, claude-plugin/goc/install.py:deck_hook_scripts\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/23545"}, "properties": {"repository": "zauberzeug/game-of-cards", "repoUrl": "https://github.com/zauberzeug/game-of-cards", "branch": "main"}, "results": [{"ruleId": "scanner-46943be4aa6dd66f", "level": "note", "message": {"text": "Possibly dead Python function: transform_context_block"}, "properties": {"repobilityId": "a3e35fdcb19f4b66", "scanner": "scanner-primary", "fingerprint": "46943be4aa6dd66f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/port_skills_to_openclaw.py:90"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c54c9c43749e8fa4", "level": "note", "message": {"text": "Possibly dead Python function: phase3"}, "properties": {"repobilityId": "9161754f93c2ea9c", "scanner": "scanner-primary", "fingerprint": "c54c9c43749e8fa4", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "openclaw-plugin/goc/engine.py:1135"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-87a6b75404e717ff", "level": "note", "message": {"text": "Possibly dead Python function: key"}, "properties": {"repobilityId": "82ad9f64418e6fec", "scanner": "scanner-primary", "fingerprint": "87a6b75404e717ff", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "openclaw-plugin/goc/engine.py:2540"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e8ee572bb495369b", "level": "note", "message": {"text": "Possibly dead Python function: phase3"}, "properties": {"repobilityId": "9161754f93c2ea9c", "scanner": "scanner-primary", "fingerprint": "e8ee572bb495369b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-plugin/goc/engine.py:1135"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fffccfde16d4e54a", "level": "note", "message": {"text": "Possibly dead Python function: key"}, "properties": {"repobilityId": "82ad9f64418e6fec", "scanner": "scanner-primary", "fingerprint": "fffccfde16d4e54a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-plugin/goc/engine.py:2540"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fdb1d26d8a7492f0", "level": "note", "message": {"text": "Possibly dead Python function: phase3"}, "properties": {"repobilityId": "9161754f93c2ea9c", "scanner": "scanner-primary", "fingerprint": "fdb1d26d8a7492f0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "goc/engine.py:1135"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-66e2cce5de387259", "level": "note", "message": {"text": "Possibly dead Python function: key"}, "properties": {"repobilityId": "82ad9f64418e6fec", "scanner": "scanner-primary", "fingerprint": "66e2cce5de387259", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "goc/engine.py:2540"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5f8ff8c96eafd6df", "level": "note", "message": {"text": "Possibly dead Python function: phase3"}, "properties": {"repobilityId": "9161754f93c2ea9c", "scanner": "scanner-primary", "fingerprint": "5f8ff8c96eafd6df", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "claude-plugin/goc/engine.py:1135"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4b1b4567df735625", "level": "note", "message": {"text": "Possibly dead Python function: key"}, "properties": {"repobilityId": "82ad9f64418e6fec", "scanner": "scanner-primary", "fingerprint": "4b1b4567df735625", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "claude-plugin/goc/engine.py:2540"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fd5ef7b6ab6a4873", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 openclaw-plugin/index.ts:521"}, "properties": {"repobilityId": "0bd85db99217d6a7", "scanner": "scanner-primary", "fingerprint": "fd5ef7b6ab6a4873", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-8f4c232b4aa78fc9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f2aa8458f6ec87a2", "scanner": "scanner-primary", "fingerprint": "8f4c232b4aa78fc9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude-code-review.yml"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-8f4c232b4aa78fc9", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7572d8d133564421", "scanner": "scanner-primary", "fingerprint": "8f4c232b4aa78fc9", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude-code-review.yml"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-77166cbd46fcd8e4", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "50f3b563ffac10e9", "scanner": "scanner-primary", "fingerprint": "77166cbd46fcd8e4", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude-code-review.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ef7e6ef84bc585df", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 38}}}]}, {"ruleId": "scanner-de53ac274e5b4ecf", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "69dd0abad9dba1dc", "scanner": "scanner-primary", "fingerprint": "de53ac274e5b4ecf", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude.yml"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-de53ac274e5b4ecf", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8ead6a2c2bfe167b", "scanner": "scanner-primary", "fingerprint": "de53ac274e5b4ecf", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude.yml"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-37716d9c0a33ad5c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "abfb5752158cf655", "scanner": "scanner-primary", "fingerprint": "37716d9c0a33ad5c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d9ed7aadf99d8f76", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 195}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "eeb76410cc935c30", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 200}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5ab0c5bd71e63ad8", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 352}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d9ed7aadf99d8f76", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 477}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8f168c7bccae0b9c", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 493}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8f168c7bccae0b9c", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 539}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b0f359fc82dc1097", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 597}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8eb96fb1706184f3", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 603}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "eeb76410cc935c30", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 625}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bb3952f854dc6c80", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 682}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e4f658c0c00de0d4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "25e1fa3783e7cb32", "scanner": "scanner-primary", "fingerprint": "e4f658c0c00de0d4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 264}}}]}, {"ruleId": "scanner-448d8837178ae57a", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "13af6451e15656fc", "scanner": "scanner-primary", "fingerprint": "448d8837178ae57a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7d0807b4438e0f95", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0336c43ec46ee90e", "scanner": "scanner-primary", "fingerprint": "7d0807b4438e0f95", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/audit-deck.yml"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-7d0807b4438e0f95", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ba2ee02493f0c189", "scanner": "scanner-primary", "fingerprint": "7d0807b4438e0f95", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/audit-deck.yml"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-7d0807b4438e0f95", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "89460ca4edd7b930", "scanner": "scanner-primary", "fingerprint": "7d0807b4438e0f95", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/audit-deck.yml"}, "region": {"startLine": 50}}}]}, {"ruleId": "scanner-112fcf1f427a62b0", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "a3fdd018eddfd4a6", "scanner": "scanner-primary", "fingerprint": "112fcf1f427a62b0", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/audit-deck.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0ff2e0753e6f5ce0", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "330603ce1c29a685", "scanner": "scanner-primary", "fingerprint": "0ff2e0753e6f5ce0", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pull-card.yml"}, "region": {"startLine": 51}}}]}, {"ruleId": "scanner-0ff2e0753e6f5ce0", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "aa27448a8f2df617", "scanner": "scanner-primary", "fingerprint": "0ff2e0753e6f5ce0", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pull-card.yml"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-0ff2e0753e6f5ce0", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "dbed84107db671b1", "scanner": "scanner-primary", "fingerprint": "0ff2e0753e6f5ce0", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pull-card.yml"}, "region": {"startLine": 75}}}]}, {"ruleId": "scanner-9e92c031b633605d", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "dfa979be9e00f2e8", "scanner": "scanner-primary", "fingerprint": "9e92c031b633605d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pull-card.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b753d02707481826", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "f067074e22c9a5fc", "scanner": "scanner-primary", "fingerprint": "b753d02707481826", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "openclaw-plugin/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f89605f572e78f82", "level": "note", "message": {"text": "Very large file: tests/test_install.py (2158 lines)"}, "properties": {"repobilityId": "dcbc990f901616ec", "scanner": "scanner-primary", "fingerprint": "f89605f572e78f82", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-7d73ea022e2c5698", "level": "note", "message": {"text": "Very large file: openclaw-plugin/goc/install.py (1724 lines)"}, "properties": {"repobilityId": "483829a6d56bb5c3", "scanner": "scanner-primary", "fingerprint": "7d73ea022e2c5698", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3cd07d8aa91ba94e", "level": "note", "message": {"text": "Very large file: openclaw-plugin/goc/engine.py (5511 lines)"}, "properties": {"repobilityId": "0dd6952d01792cad", "scanner": "scanner-primary", "fingerprint": "3cd07d8aa91ba94e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ab429f17e9263bd9", "level": "note", "message": {"text": "Very large file: codex-plugin/goc/install.py (1724 lines)"}, "properties": {"repobilityId": "6ed740a4dfe9f1d5", "scanner": "scanner-primary", "fingerprint": "ab429f17e9263bd9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-35af01d3096f25e8", "level": "note", "message": {"text": "Very large file: codex-plugin/goc/engine.py (5511 lines)"}, "properties": {"repobilityId": "85b604819304d284", "scanner": "scanner-primary", "fingerprint": "35af01d3096f25e8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-617e4434211ab474", "level": "note", "message": {"text": "Very large file: goc/install.py (1724 lines)"}, "properties": {"repobilityId": "7661c957e8ae868b", "scanner": "scanner-primary", "fingerprint": "617e4434211ab474", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5b21c320bea24aab", "level": "note", "message": {"text": "Very large file: goc/engine.py (5511 lines)"}, "properties": {"repobilityId": "e9f0d66333f118dd", "scanner": "scanner-primary", "fingerprint": "5b21c320bea24aab", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b251e58976c1bad6", "level": "note", "message": {"text": "Very large file: claude-plugin/goc/install.py (1724 lines)"}, "properties": {"repobilityId": "b60f7d43715d1264", "scanner": "scanner-primary", "fingerprint": "b251e58976c1bad6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-84fe966a6c768ba2", "level": "note", "message": {"text": "Very large file: claude-plugin/goc/engine.py (5511 lines)"}, "properties": {"repobilityId": "49eadeb8d2692112", "scanner": "scanner-primary", "fingerprint": "84fe966a6c768ba2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "bdad91045c1ad2ac", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "d0edacf5dd8d06fe", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "039adf6791344c20", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "671dd1d7da856368", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-f3e9f8d58705a596", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: openclaw-plugin/skills/openclaw-kickoff/SKILL.md"}, "properties": {"repobilityId": "8e9f5e9b755acd71", "scanner": "scanner-primary", "fingerprint": "f3e9f8d58705a596", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "openclaw-plugin/skills/openclaw-kickoff/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7957e8ac68218a23", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: openclaw-plugin/skills/openclaw-kickoff/SKILL.md"}, "properties": {"repobilityId": "79bbb70cdf56b63d", "scanner": "scanner-primary", "fingerprint": "7957e8ac68218a23", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "openclaw-plugin/skills/openclaw-kickoff/SKILL.md"}, "region": {"startLine": 58}}}]}, {"ruleId": "scanner-a4088afb1849d328", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: openclaw-plugin/skills/retrospective/SKILL.md"}, "properties": {"repobilityId": "c065d966566fe267", "scanner": "scanner-primary", "fingerprint": "a4088afb1849d328", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "openclaw-plugin/skills/retrospective/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-122f91b7f2906dc4", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "properties": {"repobilityId": "a2967269048b6a9d", "scanner": "scanner-primary", "fingerprint": "122f91b7f2906dc4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/settings.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-445a1deaaa0a0d3f", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/retrospective/SKILL.md"}, "properties": {"repobilityId": "0654048a4261f5b8", "scanner": "scanner-primary", "fingerprint": "445a1deaaa0a0d3f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/retrospective/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fd1434542600abaa", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: goc/templates/skills/openclaw-kickoff/SKILL.md"}, "properties": {"repobilityId": "b70daac8908ecfeb", "scanner": "scanner-primary", "fingerprint": "fd1434542600abaa", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "goc/templates/skills/openclaw-kickoff/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-303cdb4861d34c7d", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: goc/templates/skills/openclaw-kickoff/SKILL.md"}, "properties": {"repobilityId": "59450c26a6847b1f", "scanner": "scanner-primary", "fingerprint": "303cdb4861d34c7d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "goc/templates/skills/openclaw-kickoff/SKILL.md"}, "region": {"startLine": 58}}}]}, {"ruleId": "scanner-6b462f38c949ac4f", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: goc/templates/skills/retrospective/SKILL.md"}, "properties": {"repobilityId": "6ff2c5816595af3f", "scanner": "scanner-primary", "fingerprint": "6b462f38c949ac4f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "goc/templates/skills/retrospective/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e07d5c766fe5895b", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: claude-plugin/skills/retrospective/SKILL.md"}, "properties": {"repobilityId": "56b2810c9b53464e", "scanner": "scanner-primary", "fingerprint": "e07d5c766fe5895b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "claude-plugin/skills/retrospective/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-de414546e17c9f41", "level": "none", "message": {"text": "Commented-code block (8 lines) in tests/test_repair_edges.py:154"}, "properties": {"repobilityId": "223a21af9b2b6710", "scanner": "scanner-primary", "fingerprint": "de414546e17c9f41", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-dc26557f0bca4728", "level": "none", "message": {"text": "Commented-code block (7 lines) in scripts/sync_plugin_assets.py:310"}, "properties": {"repobilityId": "c1d46b9464c3f478", "scanner": "scanner-primary", "fingerprint": "dc26557f0bca4728", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d7acf3b78550f4fa", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/sync_plugin_assets.py:575"}, "properties": {"repobilityId": "58a5892297da8b9c", "scanner": "scanner-primary", "fingerprint": "d7acf3b78550f4fa", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-a7eae9a606201d02", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/port_skills_to_openclaw.py:40"}, "properties": {"repobilityId": "e9957bd3e7518314", "scanner": "scanner-primary", "fingerprint": "a7eae9a606201d02", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fc85984aef0a7a6a", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/release_rewrite_versions.py:127"}, "properties": {"repobilityId": "81f3793b663f5301", "scanner": "scanner-primary", "fingerprint": "fc85984aef0a7a6a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ba350e8b6ba49477", "level": "none", "message": {"text": "Commented-code block (6 lines) in openclaw-plugin/index.ts:135"}, "properties": {"repobilityId": "ce0b4eb884fbe32a", "scanner": "scanner-primary", "fingerprint": "ba350e8b6ba49477", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8afa2e32cb8b16ae", "level": "note", "message": {"text": "Legacy-named symbol `_ensure_backup` in openclaw-plugin/goc/install.py:567"}, "properties": {"repobilityId": "531c9fec947f75cd", "scanner": "scanner-primary", "fingerprint": "8afa2e32cb8b16ae", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-97a10a878cc62952", "level": "none", "message": {"text": "Commented-code block (5 lines) in openclaw-plugin/goc/install.py:689"}, "properties": {"repobilityId": "f9d021340fb45d38", "scanner": "scanner-primary", "fingerprint": "97a10a878cc62952", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-584779da84d40b0c", "level": "note", "message": {"text": "Legacy-named symbol `to_copy` in openclaw-plugin/goc/engine.py:5396"}, "properties": {"repobilityId": "f2d8bd71b359b98a", "scanner": "scanner-primary", "fingerprint": "584779da84d40b0c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-87366fe110ee22fa", "level": "none", "message": {"text": "Commented-code block (5 lines) in openclaw-plugin/goc/engine.py:181"}, "properties": {"repobilityId": "a53bbd2eafd97293", "scanner": "scanner-primary", "fingerprint": "87366fe110ee22fa", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cba12eb4ec37b007", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 openclaw-plugin/goc/engine.py:3488"}, "properties": {"repobilityId": "db01068fb5dadabf", "scanner": "scanner-primary", "fingerprint": "cba12eb4ec37b007", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2d95b7d0a1fc5077", "level": "none", "message": {"text": "Commented-code block (9 lines) in openclaw-plugin/goc/_vendor/yaml_lite.py:198"}, "properties": {"repobilityId": "6ef0327b4786ab05", "scanner": "scanner-primary", "fingerprint": "2d95b7d0a1fc5077", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ed4d09f367dc57c3", "level": "note", "message": {"text": "Legacy-named symbol `_ensure_backup` in codex-plugin/goc/install.py:567"}, "properties": {"repobilityId": "c740c9b9a3833b05", "scanner": "scanner-primary", "fingerprint": "ed4d09f367dc57c3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-54ac070aa61a900d", "level": "none", "message": {"text": "Commented-code block (5 lines) in codex-plugin/goc/install.py:689"}, "properties": {"repobilityId": "9f1520ca2512bb75", "scanner": "scanner-primary", "fingerprint": "54ac070aa61a900d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a88478664f008557", "level": "note", "message": {"text": "Legacy-named symbol `to_copy` in codex-plugin/goc/engine.py:5396"}, "properties": {"repobilityId": "c46194a3a40f9446", "scanner": "scanner-primary", "fingerprint": "a88478664f008557", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-dc03be94767c43b2", "level": "none", "message": {"text": "Commented-code block (5 lines) in codex-plugin/goc/engine.py:181"}, "properties": {"repobilityId": "b13df2bc5b9a2544", "scanner": "scanner-primary", "fingerprint": "dc03be94767c43b2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a7e521a29f7a609e", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 codex-plugin/goc/engine.py:3488"}, "properties": {"repobilityId": "ab502851f283e4ed", "scanner": "scanner-primary", "fingerprint": "a7e521a29f7a609e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-24bc15dc6e59978e", "level": "none", "message": {"text": "Commented-code block (9 lines) in codex-plugin/goc/_vendor/yaml_lite.py:198"}, "properties": {"repobilityId": "7662dcad427086ab", "scanner": "scanner-primary", "fingerprint": "24bc15dc6e59978e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-875afb8818d10248", "level": "note", "message": {"text": "Legacy-named symbol `_ensure_backup` in goc/install.py:567"}, "properties": {"repobilityId": "5c0ba74334856c96", "scanner": "scanner-primary", "fingerprint": "875afb8818d10248", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-8ac853e59254f532", "level": "none", "message": {"text": "Commented-code block (5 lines) in goc/install.py:689"}, "properties": {"repobilityId": "cb252842e650efcf", "scanner": "scanner-primary", "fingerprint": "8ac853e59254f532", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ac92b320386becba", "level": "note", "message": {"text": "Legacy-named symbol `to_copy` in goc/engine.py:5396"}, "properties": {"repobilityId": "abab12bd7ff4ee2b", "scanner": "scanner-primary", "fingerprint": "ac92b320386becba", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-5bcf0a041ccfd779", "level": "none", "message": {"text": "Commented-code block (5 lines) in goc/engine.py:181"}, "properties": {"repobilityId": "ec0b29d8fb073fb7", "scanner": "scanner-primary", "fingerprint": "5bcf0a041ccfd779", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1e3124b61f2e41ee", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 goc/engine.py:3488"}, "properties": {"repobilityId": "2da3adf36279f769", "scanner": "scanner-primary", "fingerprint": "1e3124b61f2e41ee", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-628d8d1a79614759", "level": "none", "message": {"text": "Commented-code block (9 lines) in goc/_vendor/yaml_lite.py:198"}, "properties": {"repobilityId": "7b29fef0d50d5280", "scanner": "scanner-primary", "fingerprint": "628d8d1a79614759", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-028663a7875e0dc4", "level": "note", "message": {"text": "Legacy-named symbol `_ensure_backup` in claude-plugin/goc/install.py:567"}, "properties": {"repobilityId": "cf3f49b090808f41", "scanner": "scanner-primary", "fingerprint": "028663a7875e0dc4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-16d50ae11ef6cbd3", "level": "none", "message": {"text": "Commented-code block (5 lines) in claude-plugin/goc/install.py:689"}, "properties": {"repobilityId": "7f335687cd8a3bc0", "scanner": "scanner-primary", "fingerprint": "16d50ae11ef6cbd3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f1fb25095683938a", "level": "note", "message": {"text": "Legacy-named symbol `to_copy` in claude-plugin/goc/engine.py:5396"}, "properties": {"repobilityId": "923a5af57544d0a9", "scanner": "scanner-primary", "fingerprint": "f1fb25095683938a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-4c82f9af529fca04", "level": "none", "message": {"text": "Commented-code block (5 lines) in claude-plugin/goc/engine.py:181"}, "properties": {"repobilityId": "23984345e6a5a23b", "scanner": "scanner-primary", "fingerprint": "4c82f9af529fca04", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a5765cab0d97c3a7", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 claude-plugin/goc/engine.py:3488"}, "properties": {"repobilityId": "4c50de54669cf63a", "scanner": "scanner-primary", "fingerprint": "a5765cab0d97c3a7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-0cf487c7887cfaba", "level": "none", "message": {"text": "Commented-code block (9 lines) in claude-plugin/goc/_vendor/yaml_lite.py:198"}, "properties": {"repobilityId": "5829855ca34cb5fe", "scanner": "scanner-primary", "fingerprint": "0cf487c7887cfaba", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "1a5552e9af654c4d", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "aec2ac76df1780d0", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "606ae00998f6fd9c", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "236adf12d0a7bdbb", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "39c852c45586a7f3", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "f8b195640ff13421", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "2e5e04865fbefe8a", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "ebcea5c7691b06cc", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "9763b427f5b20269", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "678bc9905b5db3f5", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "7aad8d965d042c86", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "7eb421ef41277b7d", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "a56ea9f8cc7d2a9e", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "8558e9def4c85bcb", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "6e196ccc5ba039bb", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "f64b8ea04d48155d", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "06b544255dfce767", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "e1500ede6ac9afd7", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "1351bb915f5ab233", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "2592346d68790f35", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}]}]}