{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-94f8ea1970791f62", "name": "Possibly dead Python function: t_list_sops", "shortDescription": {"text": "Possibly dead Python function: t_list_sops"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9358bd44cfdcaf3c", "name": "Possibly dead Python function: t_read_sop", "shortDescription": {"text": "Possibly dead Python function: t_read_sop"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6dff153dd2fce555", "name": "Possibly dead Python function: t_suggest_change", "shortDescription": {"text": "Possibly dead Python function: t_suggest_change"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d7d363f9164d6ac1", "name": "Possibly dead Python function: t_create_draft_sop", "shortDescription": {"text": "Possibly dead Python function: t_create_draft_sop"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4c7d94b5ac882e5b", "name": "Possibly dead Python function: t_pending_runs", "shortDescription": {"text": "Possibly dead Python function: t_pending_runs"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d5e096e961f51965", "name": "Possibly dead Python function: t_resolve_pending", "shortDescription": {"text": "Possibly dead Python function: t_resolve_pending"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e5248bb16c5e2b16", "name": "Possibly dead Python function: t_automation_costs", "shortDescription": {"text": "Possibly dead Python function: t_automation_costs"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f20570a267956d0d", "name": "Possibly dead Python function: m", "shortDescription": {"text": "Possibly dead Python function: m"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a44a592ddd6b8f2f", "name": "Possibly dead Python function: log_message", "shortDescription": {"text": "Possibly dead Python function: log_message"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-80325fdbc6d882f7", "name": "Possibly dead Python function: do_GET", "shortDescription": {"text": "Possibly dead Python function: do_GET"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6ce96d88e0fa2ff1", "name": "Possibly dead Python function: do_POST", "shortDescription": {"text": "Possibly dead Python function: do_POST"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ba826e945baf70e0", "name": "Insecure pattern 'direct_innerhtml_assignment' in assets/app.js:121", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/app.js:121"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-35c0e8f883f22465", "name": "Insecure pattern 'direct_innerhtml_assignment' in mockups/the-brief.html:317", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in mockups/the-brief.html:317"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 64 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b62b6514b60bdd22", "name": "Legacy-named symbol `test_run_marker_stalled_when_too_old` in tests/test_lib.py:115", "shortDescription": {"text": "Legacy-named symbol `test_run_marker_stalled_when_too_old` in tests/test_lib.py:115"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-841f5b6fe9c57104", "name": "Commented-code block (5 lines) in scripts/dashboard_app.py:195", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/dashboard_app.py:195"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-baa105a3cef99514", "name": "Commented-code block (5 lines) in scripts/run_sop.py:154", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/run_sop.py:154"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7b95b23922f3a775", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/sop_triggers.py:221", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/sop_triggers.py:221"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4d02ef81130b14c5", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/canary_prepare.py:132", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/canary_prepare.py:132"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b096a3d4e70e6f4d", "name": "Commented-code block (8 lines) in scripts/serve_dashboard.py:355", "shortDescription": {"text": "Commented-code block (8 lines) in scripts/serve_dashboard.py:355"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bd20f4ed059d14ad", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/serve_dashboard.py:177", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/serve_dashboard.py:177"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-15a65955ded91b2f", "name": "Stub function `log_message` (body is just `pass`/`return`) \u2014 scripts/serve_dashboard.py:758", "shortDescription": {"text": "Stub function `log_message` (body is just `pass`/`return`) \u2014 scripts/serve_dashboard.py:758"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4fa393fb90ce27f7", "name": "Commented-code block (6 lines) in assets/app.js:61", "shortDescription": {"text": "Commented-code block (6 lines) in assets/app.js:61"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c1180c41c66cf80b", "name": "`fetch()` without try/.catch or AbortSignal \u2014 assets/app.js:185", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/app.js:185"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nscripts/serve_dashboard.py:launch_permission, scripts/serve_dashboard.py:launch\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-414fbd2f85f66dc4", "name": "Dangling fetch: POST /api/resolve (assets/app.js:185)", "shortDescription": {"text": "Dangling fetch: POST /api/resolve (assets/app.js:185)"}, "fullDescription": {"text": "`assets/app.js:185` calls `POST /api/resolve` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/resolve`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7104eb5064a6cf4f", "name": "Dangling fetch: POST /api/apply-item (assets/app.js:205)", "shortDescription": {"text": "Dangling fetch: POST /api/apply-item (assets/app.js:205)"}, "fullDescription": {"text": "`assets/app.js:205` calls `POST /api/apply-item` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/apply-item`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a2d92f80d9dae652", "name": "Dangling fetch: POST /api/clear-run (assets/app.js:264)", "shortDescription": {"text": "Dangling fetch: POST /api/clear-run (assets/app.js:264)"}, "fullDescription": {"text": "`assets/app.js:264` calls `POST /api/clear-run` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/clear-run`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-337de671d79e05bc", "name": "Dangling fetch: POST /api/run (assets/app.js:439)", "shortDescription": {"text": "Dangling fetch: POST /api/run (assets/app.js:439)"}, "fullDescription": {"text": "`assets/app.js:439` calls `POST /api/run` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/run`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3cb53fc7d074f1e6", "name": "Dangling fetch: POST /api/launch (assets/app.js:518)", "shortDescription": {"text": "Dangling fetch: POST /api/launch (assets/app.js:518)"}, "fullDescription": {"text": "`assets/app.js:518` calls `POST /api/launch` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/launch`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-61ad85fdb30043da", "name": "Dangling fetch: POST /api/queue (assets/app.js:535)", "shortDescription": {"text": "Dangling fetch: POST /api/queue (assets/app.js:535)"}, "fullDescription": {"text": "`assets/app.js:535` calls `POST /api/queue` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/queue`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-27eadec8dbe764e8", "name": "Dangling fetch: POST /api/suggest (assets/app.js:568)", "shortDescription": {"text": "Dangling fetch: POST /api/suggest (assets/app.js:568)"}, "fullDescription": {"text": "`assets/app.js:568` calls `POST /api/suggest` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/suggest`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fe2406b973a41205", "name": "Dangling fetch: POST /api/settings (assets/app.js:614)", "shortDescription": {"text": "Dangling fetch: POST /api/settings (assets/app.js:614)"}, "fullDescription": {"text": "`assets/app.js:614` calls `POST /api/settings` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/settings`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-82824b0c1b814c5e", "name": "Dangling fetch: POST /api/launch-permission (assets/app.js:657)", "shortDescription": {"text": "Dangling fetch: POST /api/launch-permission (assets/app.js:657)"}, "fullDescription": {"text": "`assets/app.js:657` calls `POST /api/launch-permission` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/launch-permission`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-676389b2745e972f", "name": "Dangling fetch: GET /api/ping (assets/app.js:704)", "shortDescription": {"text": "Dangling fetch: GET /api/ping (assets/app.js:704)"}, "fullDescription": {"text": "`assets/app.js:704` calls `GET /api/ping` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/ping`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-15130bae6bee0da8", "name": "Unused endpoint: GET /api/plate", "shortDescription": {"text": "Unused endpoint: GET /api/plate"}, "fullDescription": {"text": "`scripts/dashboard_app.py` declares `GET /api/plate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ca0ee8c086b37844", "name": "Unused endpoint: GET /api/runs", "shortDescription": {"text": "Unused endpoint: GET /api/runs"}, "fullDescription": {"text": "`scripts/dashboard_app.py` declares `GET /api/runs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-43269e4e79c2e69e", "name": "Unused endpoint: GET /events", "shortDescription": {"text": "Unused endpoint: GET /events"}, "fullDescription": {"text": "`scripts/dashboard_app.py` declares `GET /events` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`scripts/dashboard_app.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1f1d9a6d12d73946", "name": "Unused endpoint: GET /assets/{path:path}", "shortDescription": {"text": "Unused endpoint: GET /assets/{path:path}"}, "fullDescription": {"text": "`scripts/dashboard_app.py` declares `GET /assets/{path:path}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/23677"}, "properties": {"repository": "zkann/smbos", "repoUrl": "https://github.com/zkann/smbos", "branch": "main"}, "results": [{"ruleId": "scanner-94f8ea1970791f62", "level": "note", "message": {"text": "Possibly dead Python function: t_list_sops"}, "properties": {"repobilityId": "df4a15fc6119bd1f", "scanner": "scanner-primary", "fingerprint": "94f8ea1970791f62", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/mcp_server.py:79"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9358bd44cfdcaf3c", "level": "note", "message": {"text": "Possibly dead Python function: t_read_sop"}, "properties": {"repobilityId": "d7858ffc43be37ba", "scanner": "scanner-primary", "fingerprint": "9358bd44cfdcaf3c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/mcp_server.py:92"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6dff153dd2fce555", "level": "note", "message": {"text": "Possibly dead Python function: t_suggest_change"}, "properties": {"repobilityId": "fb012a3a1b8448fa", "scanner": "scanner-primary", "fingerprint": "6dff153dd2fce555", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/mcp_server.py:97"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d7d363f9164d6ac1", "level": "note", "message": {"text": "Possibly dead Python function: t_create_draft_sop"}, "properties": {"repobilityId": "4075798ec41b2ade", "scanner": "scanner-primary", "fingerprint": "d7d363f9164d6ac1", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/mcp_server.py:118"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4c7d94b5ac882e5b", "level": "note", "message": {"text": "Possibly dead Python function: t_pending_runs"}, "properties": {"repobilityId": "c77212058f0c3fad", "scanner": "scanner-primary", "fingerprint": "4c7d94b5ac882e5b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/mcp_server.py:144"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d5e096e961f51965", "level": "note", "message": {"text": "Possibly dead Python function: t_resolve_pending"}, "properties": {"repobilityId": "547d6a478877cdd5", "scanner": "scanner-primary", "fingerprint": "d5e096e961f51965", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/mcp_server.py:162"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e5248bb16c5e2b16", "level": "note", "message": {"text": "Possibly dead Python function: t_automation_costs"}, "properties": {"repobilityId": "fafcf0e07d59a686", "scanner": "scanner-primary", "fingerprint": "e5248bb16c5e2b16", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/mcp_server.py:183"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f20570a267956d0d", "level": "note", "message": {"text": "Possibly dead Python function: m"}, "properties": {"repobilityId": "b0f262c59410c7da", "scanner": "scanner-primary", "fingerprint": "f20570a267956d0d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/serve_dashboard.py:436"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a44a592ddd6b8f2f", "level": "note", "message": {"text": "Possibly dead Python function: log_message"}, "properties": {"repobilityId": "965f3150b4af5b2e", "scanner": "scanner-primary", "fingerprint": "a44a592ddd6b8f2f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/serve_dashboard.py:758"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-80325fdbc6d882f7", "level": "note", "message": {"text": "Possibly dead Python function: do_GET"}, "properties": {"repobilityId": "2d943bb45e4f13bd", "scanner": "scanner-primary", "fingerprint": "80325fdbc6d882f7", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/serve_dashboard.py:769"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6ce96d88e0fa2ff1", "level": "note", "message": {"text": "Possibly dead Python function: do_POST"}, "properties": {"repobilityId": "53357410ca9379a9", "scanner": "scanner-primary", "fingerprint": "6ce96d88e0fa2ff1", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/serve_dashboard.py:799"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ba826e945baf70e0", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in assets/app.js:121"}, "properties": {"repobilityId": "dfa2c6ec1351b1ff", "scanner": "scanner-primary", "fingerprint": "ba826e945baf70e0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "assets/app.js"}, "region": {"startLine": 121}}}]}, {"ruleId": "scanner-35c0e8f883f22465", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in mockups/the-brief.html:317"}, "properties": {"repobilityId": "85a7afd3981e086f", "scanner": "scanner-primary", "fingerprint": "35c0e8f883f22465", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "mockups/the-brief.html"}, "region": {"startLine": 317}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "53e76abced8f4807", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "ec07a39887ce50ee", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "961891a833bb9b01", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "c3b28c1b41957a4a", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-b62b6514b60bdd22", "level": "note", "message": {"text": "Legacy-named symbol `test_run_marker_stalled_when_too_old` in tests/test_lib.py:115"}, "properties": {"repobilityId": "1f68290ef5d3d20e", "scanner": "scanner-primary", "fingerprint": "b62b6514b60bdd22", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-841f5b6fe9c57104", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/dashboard_app.py:195"}, "properties": {"repobilityId": "b8b14510fc7e1d19", "scanner": "scanner-primary", "fingerprint": "841f5b6fe9c57104", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-baa105a3cef99514", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/run_sop.py:154"}, "properties": {"repobilityId": "ea8a6e6dc7333ccb", "scanner": "scanner-primary", "fingerprint": "baa105a3cef99514", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7b95b23922f3a775", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/sop_triggers.py:221"}, "properties": {"repobilityId": "5d2108cd91bc6746", "scanner": "scanner-primary", "fingerprint": "7b95b23922f3a775", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-4d02ef81130b14c5", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/canary_prepare.py:132"}, "properties": {"repobilityId": "f06202c7c5f641f6", "scanner": "scanner-primary", "fingerprint": "4d02ef81130b14c5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b096a3d4e70e6f4d", "level": "none", "message": {"text": "Commented-code block (8 lines) in scripts/serve_dashboard.py:355"}, "properties": {"repobilityId": "414a6a611efb4bb9", "scanner": "scanner-primary", "fingerprint": "b096a3d4e70e6f4d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bd20f4ed059d14ad", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/serve_dashboard.py:177"}, "properties": {"repobilityId": "5152d979fed77e69", "scanner": "scanner-primary", "fingerprint": "bd20f4ed059d14ad", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-15a65955ded91b2f", "level": "note", "message": {"text": "Stub function `log_message` (body is just `pass`/`return`) \u2014 scripts/serve_dashboard.py:758"}, "properties": {"repobilityId": "abc917b226abcb97", "scanner": "scanner-primary", "fingerprint": "15a65955ded91b2f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-4fa393fb90ce27f7", "level": "none", "message": {"text": "Commented-code block (6 lines) in assets/app.js:61"}, "properties": {"repobilityId": "c95df1545964ca0a", "scanner": "scanner-primary", "fingerprint": "4fa393fb90ce27f7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c1180c41c66cf80b", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 assets/app.js:185"}, "properties": {"repobilityId": "c93da1368be7043d", "scanner": "scanner-primary", "fingerprint": "c1180c41c66cf80b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "f5fbff8a26932eed", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-414fbd2f85f66dc4", "level": "error", "message": {"text": "Dangling fetch: POST /api/resolve (assets/app.js:185)"}, "properties": {"repobilityId": "550b4031c022f51c", "scanner": "scanner-primary", "fingerprint": "414fbd2f85f66dc4", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-7104eb5064a6cf4f", "level": "error", "message": {"text": "Dangling fetch: POST /api/apply-item (assets/app.js:205)"}, "properties": {"repobilityId": "078ccc04a599dac5", "scanner": "scanner-primary", "fingerprint": "7104eb5064a6cf4f", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-a2d92f80d9dae652", "level": "error", "message": {"text": "Dangling fetch: POST /api/clear-run (assets/app.js:264)"}, "properties": {"repobilityId": "d2cb71e2f1f5a4c4", "scanner": "scanner-primary", "fingerprint": "a2d92f80d9dae652", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-337de671d79e05bc", "level": "error", "message": {"text": "Dangling fetch: POST /api/run (assets/app.js:439)"}, "properties": {"repobilityId": "b85a9506372993c0", "scanner": "scanner-primary", "fingerprint": "337de671d79e05bc", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-3cb53fc7d074f1e6", "level": "error", "message": {"text": "Dangling fetch: POST /api/launch (assets/app.js:518)"}, "properties": {"repobilityId": "fb07190a9d892822", "scanner": "scanner-primary", "fingerprint": "3cb53fc7d074f1e6", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-61ad85fdb30043da", "level": "error", "message": {"text": "Dangling fetch: POST /api/queue (assets/app.js:535)"}, "properties": {"repobilityId": "6b3b447e5b118d10", "scanner": "scanner-primary", "fingerprint": "61ad85fdb30043da", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-27eadec8dbe764e8", "level": "error", "message": {"text": "Dangling fetch: POST /api/suggest (assets/app.js:568)"}, "properties": {"repobilityId": "fba12fbe2ccd1052", "scanner": "scanner-primary", "fingerprint": "27eadec8dbe764e8", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-fe2406b973a41205", "level": "error", "message": {"text": "Dangling fetch: POST /api/settings (assets/app.js:614)"}, "properties": {"repobilityId": "a0f32d7b7dddd244", "scanner": "scanner-primary", "fingerprint": "fe2406b973a41205", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-82824b0c1b814c5e", "level": "error", "message": {"text": "Dangling fetch: POST /api/launch-permission (assets/app.js:657)"}, "properties": {"repobilityId": "d5f6b525adebd294", "scanner": "scanner-primary", "fingerprint": "82824b0c1b814c5e", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-676389b2745e972f", "level": "error", "message": {"text": "Dangling fetch: GET /api/ping (assets/app.js:704)"}, "properties": {"repobilityId": "336cfcd9e873eb27", "scanner": "scanner-primary", "fingerprint": "676389b2745e972f", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-15130bae6bee0da8", "level": "note", "message": {"text": "Unused endpoint: GET /api/plate"}, "properties": {"repobilityId": "e5d2dbf24204a428", "scanner": "scanner-primary", "fingerprint": "15130bae6bee0da8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ca0ee8c086b37844", "level": "note", "message": {"text": "Unused endpoint: GET /api/runs"}, "properties": {"repobilityId": "80c9add160ee1883", "scanner": "scanner-primary", "fingerprint": "ca0ee8c086b37844", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-43269e4e79c2e69e", "level": "note", "message": {"text": "Unused endpoint: GET /events"}, "properties": {"repobilityId": "66804027e746aae7", "scanner": "scanner-primary", "fingerprint": "43269e4e79c2e69e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "e0906f6cf946e91a", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1f1d9a6d12d73946", "level": "note", "message": {"text": "Unused endpoint: GET /assets/{path:path}"}, "properties": {"repobilityId": "99e957095054f795", "scanner": "scanner-primary", "fingerprint": "1f1d9a6d12d73946", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}