{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-b9d9c5f2e3732614", "name": "Possibly dead Python function: check_snbt_parses", "shortDescription": {"text": "Possibly dead Python function: check_snbt_parses"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b5b114049b12388b", "name": "Possibly dead Python function: check_quest_tree_validity", "shortDescription": {"text": "Possibly dead Python function: check_quest_tree_validity"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b8b46853ae7da20b", "name": "Possibly dead Python function: check_custom_items_registered", "shortDescription": {"text": "Possibly dead Python function: check_custom_items_registered"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c0cecf4735757fee", "name": "Possibly dead Python function: check_custom_items_have_assets", "shortDescription": {"text": "Possibly dead Python function: check_custom_items_have_assets"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-51dcdced15f7ee29", "name": "Possibly dead Python function: check_expected_datapacks_present", "shortDescription": {"text": "Possibly dead Python function: check_expected_datapacks_present"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-16f6641d2c2b9223", "name": "Possibly dead Python function: check_quest_lang_or_inline_coverage", "shortDescription": {"text": "Possibly dead Python function: check_quest_lang_or_inline_coverage"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e40a2ef5de753328", "name": "Possibly dead Python function: check_recipe_locks_reference_valid_items", "shortDescription": {"text": "Possibly dead Python function: check_recipe_locks_reference_valid_items"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-449923506d4c2989", "name": "Possibly dead Python function: check_loot_table_component_format", "shortDescription": {"text": "Possibly dead Python function: check_loot_table_component_format"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6334b43d6a580c76", "name": "Possibly dead Python function: check_progressivestages", "shortDescription": {"text": "Possibly dead Python function: check_progressivestages"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5e9207a2ec2540c8", "name": "Possibly dead Python function: check_no_item_rewards", "shortDescription": {"text": "Possibly dead Python function: check_no_item_rewards"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-767067f8a2041ebc", "name": "Possibly dead Python function: check_tips", "shortDescription": {"text": "Possibly dead Python function: check_tips"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9bce8c3d8abc1937", "name": "Possibly dead Python function: check_kjs_custom_rewards", "shortDescription": {"text": "Possibly dead Python function: check_kjs_custom_rewards"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5c3c7b32b9dc065c", "name": "Possibly dead Python function: check_no_modname_leakage", "shortDescription": {"text": "Possibly dead Python function: check_no_modname_leakage"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-15e315aac3f79d83", "name": "Possibly dead Python function: check_kubejs_scripts_are_nonempty", "shortDescription": {"text": "Possibly dead Python function: check_kubejs_scripts_are_nonempty"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6ed3ea49502036f9", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c4f2af16c1a304f9", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1520623a9b613bf3", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 15 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 36 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-11825279136b53a3", "name": "CI is configured but no tests are detected", "shortDescription": {"text": "CI is configured but no tests are detected"}, "fullDescription": {"text": "A CI pipeline exists, but the scan found no test files to gate. Opus labeled this generated-code pattern as config theater: release machinery exists, but it has little behavioral signal."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing tests. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bea357a6497a2d5d", "name": "Agent authority lacks a verifier contract: CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-18c4f9f6bb08e094", "name": "Commented-code block (5 lines) in packs/inkworks/kubejs/server_scripts/inkworks_parcool_chrome.js:3", "shortDescription": {"text": "Commented-code block (5 lines) in packs/inkworks/kubejs/server_scripts/inkworks_parcool_chrome.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1ace79de0f06edaa", "name": "Legacy-named symbol `campsite_built_v1` in packs/inkworks/kubejs/server_scripts/inkworks_campsite_spawn.js:15", "shortDescription": {"text": "Legacy-named symbol `campsite_built_v1` in packs/inkworks/kubejs/server_scripts/inkworks_campsite_spawn.js:15"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4936c2e1d586d035", "name": "Commented-code block (5 lines) in packs/inkworks/kubejs/server_scripts/inkworks_campsite_spawn.js:3", "shortDescription": {"text": "Commented-code block (5 lines) in packs/inkworks/kubejs/server_scripts/inkworks_campsite_spawn.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a368a00e2481ae7b", "name": "Commented-code block (5 lines) in packs/inkworks/kubejs/server_scripts/inkworks_silence_announcements.js:1", "shortDescription": {"text": "Commented-code block (5 lines) in packs/inkworks/kubejs/server_scripts/inkworks_silence_announcements.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8879d61a6a2f3b23", "name": "Legacy-named symbol `mana_initialized_v2` in packs/inkworks/kubejs/server_scripts/inkworks_initial_mana.js:10", "shortDescription": {"text": "Legacy-named symbol `mana_initialized_v2` in packs/inkworks/kubejs/server_scripts/inkworks_initial_mana.js:10"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f158dbb8bcd791ad", "name": "Commented-code block (6 lines) in packs/inkworks/kubejs/server_scripts/inkworks_hard_mode.js:5", "shortDescription": {"text": "Commented-code block (6 lines) in packs/inkworks/kubejs/server_scripts/inkworks_hard_mode.js:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-56d47549241a95a1", "name": "Commented-code block (8 lines) in packs/inkworks/kubejs/startup_scripts/inkworks_controlify_parcool_bridge.js:1", "shortDescription": {"text": "Commented-code block (8 lines) in packs/inkworks/kubejs/startup_scripts/inkworks_controlify_parcool_bridge.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4b5df8657137d17f", "name": "Commented-code block (10 lines) in scripts/inkworks-preflight.py:37", "shortDescription": {"text": "Commented-code block (10 lines) in scripts/inkworks-preflight.py:37"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-78139e4c95f8adb4", "name": "Commented-code block (6 lines) in scripts/inkworks-dump-advancements.py:52", "shortDescription": {"text": "Commented-code block (6 lines) in scripts/inkworks-dump-advancements.py:52"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/22958"}, "properties": {"repository": "xanister/inkcraft", "repoUrl": "https://github.com/xanister/inkcraft", "branch": "main"}, "results": [{"ruleId": "scanner-b9d9c5f2e3732614", "level": "note", "message": {"text": "Possibly dead Python function: check_snbt_parses"}, "properties": {"repobilityId": "2f96fdd7cf6f5481", "scanner": "scanner-primary", "fingerprint": "b9d9c5f2e3732614", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/inkworks-preflight.py:461"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b5b114049b12388b", "level": "note", "message": {"text": "Possibly dead Python function: check_quest_tree_validity"}, "properties": {"repobilityId": "f2f9e20806526eee", "scanner": "scanner-primary", "fingerprint": "b5b114049b12388b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/inkworks-preflight.py:480"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b8b46853ae7da20b", "level": "note", "message": {"text": "Possibly dead Python function: check_custom_items_registered"}, "properties": {"repobilityId": "d31a4451601beeea", "scanner": "scanner-primary", "fingerprint": "b8b46853ae7da20b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/inkworks-preflight.py:499"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c0cecf4735757fee", "level": "note", "message": {"text": "Possibly dead Python function: check_custom_items_have_assets"}, "properties": {"repobilityId": "beff17a3e4b2d4ab", "scanner": "scanner-primary", "fingerprint": "c0cecf4735757fee", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/inkworks-preflight.py:517"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-51dcdced15f7ee29", "level": "note", "message": {"text": "Possibly dead Python function: check_expected_datapacks_present"}, "properties": {"repobilityId": "c947a757e453d2c0", "scanner": "scanner-primary", "fingerprint": "51dcdced15f7ee29", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/inkworks-preflight.py:535"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-16f6641d2c2b9223", "level": "note", "message": {"text": "Possibly dead Python function: check_quest_lang_or_inline_coverage"}, "properties": {"repobilityId": "c00b1a6ef8a049ca", "scanner": "scanner-primary", "fingerprint": "16f6641d2c2b9223", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/inkworks-preflight.py:546"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e40a2ef5de753328", "level": "note", "message": {"text": "Possibly dead Python function: check_recipe_locks_reference_valid_items"}, "properties": {"repobilityId": "3802094eb12fa516", "scanner": "scanner-primary", "fingerprint": "e40a2ef5de753328", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/inkworks-preflight.py:565"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-449923506d4c2989", "level": "note", "message": {"text": "Possibly dead Python function: check_loot_table_component_format"}, "properties": {"repobilityId": "4b72230c09e05499", "scanner": "scanner-primary", "fingerprint": "449923506d4c2989", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/inkworks-preflight.py:613"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6334b43d6a580c76", "level": "note", "message": {"text": "Possibly dead Python function: check_progressivestages"}, "properties": {"repobilityId": "c53df0b00ca8ae32", "scanner": "scanner-primary", "fingerprint": "6334b43d6a580c76", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/inkworks-preflight.py:672"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5e9207a2ec2540c8", "level": "note", "message": {"text": "Possibly dead Python function: check_no_item_rewards"}, "properties": {"repobilityId": "72467ce43899775b", "scanner": "scanner-primary", "fingerprint": "5e9207a2ec2540c8", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/inkworks-preflight.py:772"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-767067f8a2041ebc", "level": "note", "message": {"text": "Possibly dead Python function: check_tips"}, "properties": {"repobilityId": "3a130b1c89c13259", "scanner": "scanner-primary", "fingerprint": "767067f8a2041ebc", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/inkworks-preflight.py:790"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9bce8c3d8abc1937", "level": "note", "message": {"text": "Possibly dead Python function: check_kjs_custom_rewards"}, "properties": {"repobilityId": "920504e78d380472", "scanner": "scanner-primary", "fingerprint": "9bce8c3d8abc1937", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/inkworks-preflight.py:839"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5c3c7b32b9dc065c", "level": "note", "message": {"text": "Possibly dead Python function: check_no_modname_leakage"}, "properties": {"repobilityId": "e93f386eff9f2da9", "scanner": "scanner-primary", "fingerprint": "5c3c7b32b9dc065c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/inkworks-preflight.py:855"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-15e315aac3f79d83", "level": "note", "message": {"text": "Possibly dead Python function: check_kubejs_scripts_are_nonempty"}, "properties": {"repobilityId": "f156d86e8c697ba7", "scanner": "scanner-primary", "fingerprint": "15e315aac3f79d83", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/inkworks-preflight.py:923"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-6ed3ea49502036f9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "60ce95aaf1cc6502", "scanner": "scanner-primary", "fingerprint": "6ed3ea49502036f9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "mods-src/inkworks-atlas-fix/.github/workflows/build.yml"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-6ed3ea49502036f9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e6bfa15381e38cbf", "scanner": "scanner-primary", "fingerprint": "6ed3ea49502036f9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "mods-src/inkworks-atlas-fix/.github/workflows/build.yml"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-6ed3ea49502036f9", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ff138ac0bd676693", "scanner": "scanner-primary", "fingerprint": "6ed3ea49502036f9", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "mods-src/inkworks-atlas-fix/.github/workflows/build.yml"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-c4f2af16c1a304f9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f193e8e4be0b86dd", "scanner": "scanner-primary", "fingerprint": "c4f2af16c1a304f9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/refresh.yml"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-c4f2af16c1a304f9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f193e8e4be0b86dd", "scanner": "scanner-primary", "fingerprint": "c4f2af16c1a304f9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/refresh.yml"}, "region": {"startLine": 87}}}]}, {"ruleId": "scanner-c4f2af16c1a304f9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "67319cf05629a4bc", "scanner": "scanner-primary", "fingerprint": "c4f2af16c1a304f9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/refresh.yml"}, "region": {"startLine": 90}}}]}, {"ruleId": "scanner-c4f2af16c1a304f9", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5cfe10f6091c3c87", "scanner": "scanner-primary", "fingerprint": "c4f2af16c1a304f9", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/refresh.yml"}, "region": {"startLine": 130}}}]}, {"ruleId": "scanner-1520623a9b613bf3", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "0dc14612ff72d74f", "scanner": "scanner-primary", "fingerprint": "1520623a9b613bf3", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/refresh.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "a69760c5b7b7d4d1", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-11825279136b53a3", "level": "warning", "message": {"text": "CI is configured but no tests are detected"}, "properties": {"repobilityId": "5717fcd33d95026a", "scanner": "scanner-primary", "fingerprint": "11825279136b53a3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "ci", "config-theater", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "5d429ad6c8c8b8c8", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "74b79a4e407a0412", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "486238a1ea65b3ed", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-bea357a6497a2d5d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: CLAUDE.md"}, "properties": {"repobilityId": "aae72df3934829ac", "scanner": "scanner-primary", "fingerprint": "bea357a6497a2d5d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-18c4f9f6bb08e094", "level": "none", "message": {"text": "Commented-code block (5 lines) in packs/inkworks/kubejs/server_scripts/inkworks_parcool_chrome.js:3"}, "properties": {"repobilityId": "bee7005e0ce3c82b", "scanner": "scanner-primary", "fingerprint": "18c4f9f6bb08e094", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1ace79de0f06edaa", "level": "note", "message": {"text": "Legacy-named symbol `campsite_built_v1` in packs/inkworks/kubejs/server_scripts/inkworks_campsite_spawn.js:15"}, "properties": {"repobilityId": "b76d36cba956736c", "scanner": "scanner-primary", "fingerprint": "1ace79de0f06edaa", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-4936c2e1d586d035", "level": "none", "message": {"text": "Commented-code block (5 lines) in packs/inkworks/kubejs/server_scripts/inkworks_campsite_spawn.js:3"}, "properties": {"repobilityId": "1c40b116d3d67e66", "scanner": "scanner-primary", "fingerprint": "4936c2e1d586d035", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a368a00e2481ae7b", "level": "none", "message": {"text": "Commented-code block (5 lines) in packs/inkworks/kubejs/server_scripts/inkworks_silence_announcements.js:1"}, "properties": {"repobilityId": "3e50affad8e7bf78", "scanner": "scanner-primary", "fingerprint": "a368a00e2481ae7b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8879d61a6a2f3b23", "level": "note", "message": {"text": "Legacy-named symbol `mana_initialized_v2` in packs/inkworks/kubejs/server_scripts/inkworks_initial_mana.js:10"}, "properties": {"repobilityId": "1a2be5f8f4ff83f9", "scanner": "scanner-primary", "fingerprint": "8879d61a6a2f3b23", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-f158dbb8bcd791ad", "level": "none", "message": {"text": "Commented-code block (6 lines) in packs/inkworks/kubejs/server_scripts/inkworks_hard_mode.js:5"}, "properties": {"repobilityId": "6c94c9986af92c21", "scanner": "scanner-primary", "fingerprint": "f158dbb8bcd791ad", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-56d47549241a95a1", "level": "none", "message": {"text": "Commented-code block (8 lines) in packs/inkworks/kubejs/startup_scripts/inkworks_controlify_parcool_bridge.js:1"}, "properties": {"repobilityId": "a661642f251e731f", "scanner": "scanner-primary", "fingerprint": "56d47549241a95a1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4b5df8657137d17f", "level": "none", "message": {"text": "Commented-code block (10 lines) in scripts/inkworks-preflight.py:37"}, "properties": {"repobilityId": "c0fe67a782677c94", "scanner": "scanner-primary", "fingerprint": "4b5df8657137d17f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-78139e4c95f8adb4", "level": "none", "message": {"text": "Commented-code block (6 lines) in scripts/inkworks-dump-advancements.py:52"}, "properties": {"repobilityId": "9e9903300eec9c53", "scanner": "scanner-primary", "fingerprint": "78139e4c95f8adb4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}]}]}