{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-c2d6177d91a307da", "name": "Possible secret in tests/unit/logger/verbose-log.test.ts", "shortDescription": {"text": "Possible secret in tests/unit/logger/verbose-log.test.ts"}, "fullDescription": {"text": "Detected pattern matching generic_api_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-a15b36c70b86ea72", "name": "Insecure pattern 'node_child_process' in specrunner/changes/archive/2026-05-13-cli-git-commit-push/state.json:284", "shortDescription": {"text": "Insecure pattern 'node_child_process' in specrunner/changes/archive/2026-05-13-cli-git-commit-push/state.json:284"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c5fef2f7ffecc9f4", "name": "Insecure pattern 'node_child_process' in src/util/git-exec.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/util/git-exec.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-40312516caa2bd2c", "name": "Insecure pattern 'node_child_process' in src/git/remote.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/git/remote.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5416c34cec738df6", "name": "Insecure pattern 'node_child_process' in src/git/dynamic-context.ts:10", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/git/dynamic-context.ts:10"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d9bc432185329687", "name": "Insecure pattern 'node_child_process' in src/git/transport-auth.ts:11", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/git/transport-auth.ts:11"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7fd8c54488896bbe", "name": "Insecure pattern 'node_child_process' in src/git/__tests__/transport-auth.test.ts:2", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/git/__tests__/transport-auth.test.ts:2"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ff831237f19af79e", "name": "Insecure pattern 'node_child_process' in src/core/verification/commands.ts:7", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/core/verification/commands.ts:7"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-02591f1a8fb1d718", "name": "Possible secret in src/logger/__tests__/mask-sensitive.test.ts", "shortDescription": {"text": "Possible secret in src/logger/__tests__/mask-sensitive.test.ts"}, "fullDescription": {"text": "Detected pattern matching openai_or_anthropic_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-f0b45fb9ac3acc8c", "name": "Insecure pattern 'node_child_process' in src/cli/doctor.ts:9", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/cli/doctor.ts:9"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cbe310f193a6df9f", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7ffa33751be3d771", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6489e1e441d79700", "name": "Very large file: tests/pipeline-integration.test.ts (1676 lines)", "shortDescription": {"text": "Very large file: tests/pipeline-integration.test.ts (1676 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d239dd31654c00bd", "name": "Very large file: tests/unit/step/executor.test.ts (1328 lines)", "shortDescription": {"text": "Very large file: tests/unit/step/executor.test.ts (1328 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2309f4cf7fbe19d4", "name": "Very large file: tests/unit/adapter/claude-code/agent-runner.test.ts (2951 lines)", "shortDescription": {"text": "Very large file: tests/unit/adapter/claude-code/agent-runner.test.ts (2951 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-67a0c1b1f2c6c29d", "name": "Very large file: tests/unit/adapter/managed-agent/agent-runner.test.ts (2022 lines)", "shortDescription": {"text": "Very large file: tests/unit/adapter/managed-agent/agent-runner.test.ts (2022 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 13 placeholder/mock markers across 12 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ffc3fbfe4d78b9cc", "name": "Commented-code block (5 lines) in tests/cli-stdout-snapshot.test.ts:176", "shortDescription": {"text": "Commented-code block (5 lines) in tests/cli-stdout-snapshot.test.ts:176"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8e249393fda426f0", "name": "Commented-code block (5 lines) in tests/pipeline-integration.test.ts:556", "shortDescription": {"text": "Commented-code block (5 lines) in tests/pipeline-integration.test.ts:556"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b0ed8e462d32acea", "name": "Commented-code block (5 lines) in tests/unit/architecture/arch-allowlist.ts:53", "shortDescription": {"text": "Commented-code block (5 lines) in tests/unit/architecture/arch-allowlist.ts:53"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-15fb2acac42c42d4", "name": "Legacy-named symbol `draftPathLegacy` in tests/unit/util/paths.test.ts:5", "shortDescription": {"text": "Legacy-named symbol `draftPathLegacy` in tests/unit/util/paths.test.ts:5"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c2e0d98de3f07ad", "name": "Commented-code block (6 lines) in tests/unit/step/step-io-contracts.test.ts:421", "shortDescription": {"text": "Commented-code block (6 lines) in tests/unit/step/step-io-contracts.test.ts:421"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9b1b1fe8b323f8cc", "name": "Commented-code block (5 lines) in tests/unit/step/review-exit-contract.test.ts:402", "shortDescription": {"text": "Commented-code block (5 lines) in tests/unit/step/review-exit-contract.test.ts:402"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8d6e6f44507f3554", "name": "Commented-code block (6 lines) in tests/unit/core/pipeline/pipeline.transitions.test.ts:216", "shortDescription": {"text": "Commented-code block (6 lines) in tests/unit/core/pipeline/pipeline.transitions.test.ts:216"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b9dcbbca12564ae2", "name": "Commented-code block (5 lines) in tests/unit/core/pipeline/pipeline.conformance-routing.test.ts:418", "shortDescription": {"text": "Commented-code block (5 lines) in tests/unit/core/pipeline/pipeline.conformance-routing.test.ts:418"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6eafacd292cf8716", "name": "Commented-code block (8 lines) in tests/unit/core/pipeline/pipeline.reverification.test.ts:213", "shortDescription": {"text": "Commented-code block (8 lines) in tests/unit/core/pipeline/pipeline.reverification.test.ts:213"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a3260ea82a5f7ac8", "name": "Commented-code block (5 lines) in tests/unit/core/pipeline/pipeline.loop-iter-stdout.test.ts:431", "shortDescription": {"text": "Commented-code block (5 lines) in tests/unit/core/pipeline/pipeline.loop-iter-stdout.test.ts:431"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0eb0ea1364e052de", "name": "Commented-code block (6 lines) in tests/unit/core/pipeline/pipeline.episode-reset.test.ts:168", "shortDescription": {"text": "Commented-code block (6 lines) in tests/unit/core/pipeline/pipeline.episode-reset.test.ts:168"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a561ffe4a15858e5", "name": "Commented-code block (5 lines) in tests/unit/cli/resume.test.ts:143", "shortDescription": {"text": "Commented-code block (5 lines) in tests/unit/cli/resume.test.ts:143"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b788f700b4f9048a", "name": "Commented-code block (7 lines) in tests/unit/adapter/claude-code/agent-runner.test.ts:319", "shortDescription": {"text": "Commented-code block (7 lines) in tests/unit/adapter/claude-code/agent-runner.test.ts:319"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-258f72d0d0deb65d", "name": "Commented-code block (5 lines) in tests/unit/adapter/managed-agent/agent-runner.test.ts:594", "shortDescription": {"text": "Commented-code block (5 lines) in tests/unit/adapter/managed-agent/agent-runner.test.ts:594"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cd3d507ae8ed0081", "name": "Legacy-named symbol `agent_old` in tests/unit/config/migrate.test.ts:104", "shortDescription": {"text": "Legacy-named symbol `agent_old` in tests/unit/config/migrate.test.ts:104"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f26ee53488c18dee", "name": "Commented-code block (5 lines) in tests/adapter/codex/agent-runner.test.ts:470", "shortDescription": {"text": "Commented-code block (5 lines) in tests/adapter/codex/agent-runner.test.ts:470"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-98215a28991b3891", "name": "Commented-code block (10 lines) in tests/config/schema-type-parity.test-d.ts:30", "shortDescription": {"text": "Commented-code block (10 lines) in tests/config/schema-type-parity.test-d.ts:30"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9b7648f218364d47", "name": "Commented-code block (8 lines) in tests/config/step-config.test.ts:244", "shortDescription": {"text": "Commented-code block (8 lines) in tests/config/step-config.test.ts:244"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-28295887525f7df7", "name": "Legacy-named symbol `draftPathLegacy` in src/util/paths.ts:152", "shortDescription": {"text": "Legacy-named symbol `draftPathLegacy` in src/util/paths.ts:152"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a9facaabf40f136e", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/git/__tests__/transport-auth.test.ts:520", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/git/__tests__/transport-auth.test.ts:520"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-31be93e3ab937cc9", "name": "Commented-code block (5 lines) in src/core/port/report-result.ts:118", "shortDescription": {"text": "Commented-code block (5 lines) in src/core/port/report-result.ts:118"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-10a4ea9840a12665", "name": "Commented-code block (8 lines) in src/core/pipeline/pipeline.ts:350", "shortDescription": {"text": "Commented-code block (8 lines) in src/core/pipeline/pipeline.ts:350"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a5460384b1cd77b5", "name": "Commented-code block (6 lines) in src/core/pipeline/types.ts:167", "shortDescription": {"text": "Commented-code block (6 lines) in src/core/pipeline/types.ts:167"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-37978593f44e43c5", "name": "Commented-code block (6 lines) in src/core/step/adr-gen.ts:157", "shortDescription": {"text": "Commented-code block (6 lines) in src/core/step/adr-gen.ts:157"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-dd5a96e1be9975b1", "name": "Commented-code block (5 lines) in src/core/step/executor.ts:187", "shortDescription": {"text": "Commented-code block (5 lines) in src/core/step/executor.ts:187"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-93dcafa4f53823e2", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/core/doctor/checks/auth/managed-key-valid.ts:4", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/core/doctor/checks/auth/managed-key-valid.ts:4"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cea382fc2e25b981", "name": "Commented-code block (5 lines) in src/core/usage/pricing.ts:103", "shortDescription": {"text": "Commented-code block (5 lines) in src/core/usage/pricing.ts:103"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-581553af6e437e68", "name": "Commented-code block (5 lines) in src/core/inbox/planner.ts:259", "shortDescription": {"text": "Commented-code block (5 lines) in src/core/inbox/planner.ts:259"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/25060"}, "properties": {"repository": "color4pen/spec-runner", "repoUrl": "https://github.com/color4pen/spec-runner", "branch": "main"}, "results": [{"ruleId": "scanner-c2d6177d91a307da", "level": "error", "message": {"text": "Possible secret in tests/unit/logger/verbose-log.test.ts"}, "properties": {"repobilityId": "a2d8289f94f74082", "scanner": "scanner-primary", "fingerprint": "c2d6177d91a307da", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/unit/logger/verbose-log.test.ts"}, "region": {"startLine": 154}}}]}, {"ruleId": "scanner-a15b36c70b86ea72", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in specrunner/changes/archive/2026-05-13-cli-git-commit-push/state.json:284"}, "properties": {"repobilityId": "1fa3b946f64b101e", "scanner": "scanner-primary", "fingerprint": "a15b36c70b86ea72", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "specrunner/changes/archive/2026-05-13-cli-git-commit-push/state.json"}, "region": {"startLine": 284}}}]}, {"ruleId": "scanner-c5fef2f7ffecc9f4", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/util/git-exec.ts:1"}, "properties": {"repobilityId": "4cfa3b4bb7a3030a", "scanner": "scanner-primary", "fingerprint": "c5fef2f7ffecc9f4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/util/git-exec.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-40312516caa2bd2c", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/git/remote.ts:1"}, "properties": {"repobilityId": "7b7896b0992d27a4", "scanner": "scanner-primary", "fingerprint": "40312516caa2bd2c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/git/remote.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5416c34cec738df6", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/git/dynamic-context.ts:10"}, "properties": {"repobilityId": "d7442b4996463bf5", "scanner": "scanner-primary", "fingerprint": "5416c34cec738df6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/git/dynamic-context.ts"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-d9bc432185329687", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/git/transport-auth.ts:11"}, "properties": {"repobilityId": "27e2f46ccf3a9165", "scanner": "scanner-primary", "fingerprint": "d9bc432185329687", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/git/transport-auth.ts"}, "region": {"startLine": 11}}}]}, {"ruleId": "scanner-7fd8c54488896bbe", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/git/__tests__/transport-auth.test.ts:2"}, "properties": {"repobilityId": "ef866ea3c629b24d", "scanner": "scanner-primary", "fingerprint": "7fd8c54488896bbe", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/git/__tests__/transport-auth.test.ts"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-ff831237f19af79e", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/core/verification/commands.ts:7"}, "properties": {"repobilityId": "e51de93414cc89bf", "scanner": "scanner-primary", "fingerprint": "ff831237f19af79e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/core/verification/commands.ts"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-02591f1a8fb1d718", "level": "error", "message": {"text": "Possible secret in src/logger/__tests__/mask-sensitive.test.ts"}, "properties": {"repobilityId": "ee69d10b55120c8e", "scanner": "scanner-primary", "fingerprint": "02591f1a8fb1d718", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/logger/__tests__/mask-sensitive.test.ts"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-f0b45fb9ac3acc8c", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/cli/doctor.ts:9"}, "properties": {"repobilityId": "afaef5e59d4d0c36", "scanner": "scanner-primary", "fingerprint": "f0b45fb9ac3acc8c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/cli/doctor.ts"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-cbe310f193a6df9f", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "573212e145c44806", "scanner": "scanner-primary", "fingerprint": "cbe310f193a6df9f", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release-please.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7ffa33751be3d771", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "491a3ad29cbaf189", "scanner": "scanner-primary", "fingerprint": "7ffa33751be3d771", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6489e1e441d79700", "level": "note", "message": {"text": "Very large file: tests/pipeline-integration.test.ts (1676 lines)"}, "properties": {"repobilityId": "76cf4eeacd45d3d1", "scanner": "scanner-primary", "fingerprint": "6489e1e441d79700", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d239dd31654c00bd", "level": "note", "message": {"text": "Very large file: tests/unit/step/executor.test.ts (1328 lines)"}, "properties": {"repobilityId": "0c6fd60e0c6e1b6a", "scanner": "scanner-primary", "fingerprint": "d239dd31654c00bd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2309f4cf7fbe19d4", "level": "note", "message": {"text": "Very large file: tests/unit/adapter/claude-code/agent-runner.test.ts (2951 lines)"}, "properties": {"repobilityId": "13a4c033eff295ac", "scanner": "scanner-primary", "fingerprint": "2309f4cf7fbe19d4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-67a0c1b1f2c6c29d", "level": "note", "message": {"text": "Very large file: tests/unit/adapter/managed-agent/agent-runner.test.ts (2022 lines)"}, "properties": {"repobilityId": "cd38cdc4d9e89ee9", "scanner": "scanner-primary", "fingerprint": "67a0c1b1f2c6c29d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "f0dd9dc7f51f0cfa", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "e4f9e00a918c2226", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ffc3fbfe4d78b9cc", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/cli-stdout-snapshot.test.ts:176"}, "properties": {"repobilityId": "0075839983503030", "scanner": "scanner-primary", "fingerprint": "ffc3fbfe4d78b9cc", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8e249393fda426f0", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/pipeline-integration.test.ts:556"}, "properties": {"repobilityId": "df62e6620bdba4b7", "scanner": "scanner-primary", "fingerprint": "8e249393fda426f0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b0ed8e462d32acea", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/unit/architecture/arch-allowlist.ts:53"}, "properties": {"repobilityId": "812065993c0b4e22", "scanner": "scanner-primary", "fingerprint": "b0ed8e462d32acea", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-15fb2acac42c42d4", "level": "note", "message": {"text": "Legacy-named symbol `draftPathLegacy` in tests/unit/util/paths.test.ts:5"}, "properties": {"repobilityId": "cbba2143fe7d6fb6", "scanner": "scanner-primary", "fingerprint": "15fb2acac42c42d4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-2c2e0d98de3f07ad", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/unit/step/step-io-contracts.test.ts:421"}, "properties": {"repobilityId": "c97acc397c9ed7dd", "scanner": "scanner-primary", "fingerprint": "2c2e0d98de3f07ad", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9b1b1fe8b323f8cc", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/unit/step/review-exit-contract.test.ts:402"}, "properties": {"repobilityId": "d93d7c8206e8a3ac", "scanner": "scanner-primary", "fingerprint": "9b1b1fe8b323f8cc", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8d6e6f44507f3554", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/unit/core/pipeline/pipeline.transitions.test.ts:216"}, "properties": {"repobilityId": "df839abe275ecdd4", "scanner": "scanner-primary", "fingerprint": "8d6e6f44507f3554", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b9dcbbca12564ae2", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/unit/core/pipeline/pipeline.conformance-routing.test.ts:418"}, "properties": {"repobilityId": "0702a4a4dcd81116", "scanner": "scanner-primary", "fingerprint": "b9dcbbca12564ae2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6eafacd292cf8716", "level": "none", "message": {"text": "Commented-code block (8 lines) in tests/unit/core/pipeline/pipeline.reverification.test.ts:213"}, "properties": {"repobilityId": "700506c50d98e65e", "scanner": "scanner-primary", "fingerprint": "6eafacd292cf8716", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a3260ea82a5f7ac8", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/unit/core/pipeline/pipeline.loop-iter-stdout.test.ts:431"}, "properties": {"repobilityId": "eda155586434ef36", "scanner": "scanner-primary", "fingerprint": "a3260ea82a5f7ac8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0eb0ea1364e052de", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/unit/core/pipeline/pipeline.episode-reset.test.ts:168"}, "properties": {"repobilityId": "782415ca205197c5", "scanner": "scanner-primary", "fingerprint": "0eb0ea1364e052de", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a561ffe4a15858e5", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/unit/cli/resume.test.ts:143"}, "properties": {"repobilityId": "74026dad2f55c88b", "scanner": "scanner-primary", "fingerprint": "a561ffe4a15858e5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b788f700b4f9048a", "level": "none", "message": {"text": "Commented-code block (7 lines) in tests/unit/adapter/claude-code/agent-runner.test.ts:319"}, "properties": {"repobilityId": "b69b8f00dc622bfc", "scanner": "scanner-primary", "fingerprint": "b788f700b4f9048a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-258f72d0d0deb65d", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/unit/adapter/managed-agent/agent-runner.test.ts:594"}, "properties": {"repobilityId": "0fed192818c9311d", "scanner": "scanner-primary", "fingerprint": "258f72d0d0deb65d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cd3d507ae8ed0081", "level": "note", "message": {"text": "Legacy-named symbol `agent_old` in tests/unit/config/migrate.test.ts:104"}, "properties": {"repobilityId": "2d7d67488594a3d8", "scanner": "scanner-primary", "fingerprint": "cd3d507ae8ed0081", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-f26ee53488c18dee", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/adapter/codex/agent-runner.test.ts:470"}, "properties": {"repobilityId": "b9455df5f9e82243", "scanner": "scanner-primary", "fingerprint": "f26ee53488c18dee", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-98215a28991b3891", "level": "none", "message": {"text": "Commented-code block (10 lines) in tests/config/schema-type-parity.test-d.ts:30"}, "properties": {"repobilityId": "6915b3496654f9fc", "scanner": "scanner-primary", "fingerprint": "98215a28991b3891", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9b7648f218364d47", "level": "none", "message": {"text": "Commented-code block (8 lines) in tests/config/step-config.test.ts:244"}, "properties": {"repobilityId": "8b857b86b38678c7", "scanner": "scanner-primary", "fingerprint": "9b7648f218364d47", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-28295887525f7df7", "level": "note", "message": {"text": "Legacy-named symbol `draftPathLegacy` in src/util/paths.ts:152"}, "properties": {"repobilityId": "e09dca0901aabf52", "scanner": "scanner-primary", "fingerprint": "28295887525f7df7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-a9facaabf40f136e", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/git/__tests__/transport-auth.test.ts:520"}, "properties": {"repobilityId": "e3d8993250b32de1", "scanner": "scanner-primary", "fingerprint": "a9facaabf40f136e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-31be93e3ab937cc9", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/core/port/report-result.ts:118"}, "properties": {"repobilityId": "13dd609c24c855f4", "scanner": "scanner-primary", "fingerprint": "31be93e3ab937cc9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-10a4ea9840a12665", "level": "none", "message": {"text": "Commented-code block (8 lines) in src/core/pipeline/pipeline.ts:350"}, "properties": {"repobilityId": "6bf036f73bd488da", "scanner": "scanner-primary", "fingerprint": "10a4ea9840a12665", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a5460384b1cd77b5", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/core/pipeline/types.ts:167"}, "properties": {"repobilityId": "b4c320e930d57f07", "scanner": "scanner-primary", "fingerprint": "a5460384b1cd77b5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-37978593f44e43c5", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/core/step/adr-gen.ts:157"}, "properties": {"repobilityId": "4f5ca1a00c3897fd", "scanner": "scanner-primary", "fingerprint": "37978593f44e43c5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-dd5a96e1be9975b1", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/core/step/executor.ts:187"}, "properties": {"repobilityId": "3cf4e04c0f73de99", "scanner": "scanner-primary", "fingerprint": "dd5a96e1be9975b1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-93dcafa4f53823e2", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/core/doctor/checks/auth/managed-key-valid.ts:4"}, "properties": {"repobilityId": "115a7f005c6ecc0a", "scanner": "scanner-primary", "fingerprint": "93dcafa4f53823e2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-cea382fc2e25b981", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/core/usage/pricing.ts:103"}, "properties": {"repobilityId": "0317b6f5ad55223d", "scanner": "scanner-primary", "fingerprint": "cea382fc2e25b981", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-581553af6e437e68", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/core/inbox/planner.ts:259"}, "properties": {"repobilityId": "4f9d7bdd2549f9b4", "scanner": "scanner-primary", "fingerprint": "581553af6e437e68", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}]}]}