{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:04.246410Z","repo":{"ref":{"host":"github.com","owner":"elthommy","name":"privy-council"},"default_branch":"main","clone_url":"https://github.com/elthommy/privy-council.git","html_url":"https://github.com/elthommy/privy-council","description":"A private council of AI personas that debates your questions, on local models, your Claude subscription, or both.","stars":1,"forks":0,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":6376,"primary_language":"Python","license_spdx":"MIT","created_at":"2026-10-28T11:21:10Z","pushed_at":"2026-11-14T11:23:01Z","security_policy_url":null,"distribution":{"owner_created_at":"2013-07-21T15:45:41Z","owner_type":"User","release_assets":[]}},"commit_sha":"c869ce38e8b7b5c45767972f097dda63d8528343","profile":{"lines_by_language":{"Python":34015,"Shell":65},"files_by_category":{"source":107,"test":77,"docs":46,"config":16,"other":3,"binary":2,"oversized":1,"generated":1},"source_lines":21092,"test_lines":12988},"pillars":{"ai_provenance":{"score":12.2,"confidence":0.85,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.1216,"suspected_share":0.0,"estimated_share":0.1216,"ai_artifacts":1.0,"flagged_work_units":0.0,"flagged_releases":null,"style_index":0.0},"summary":"Explicit AI attribution on 12% of first-party code added; an estimated 12% including velocity signals."},"quality":{"score":88.6,"confidence":0.9,"coverage":1.0,"label":"strong","breakdown":{"complexity":90.4,"duplication":93.5,"lint":74.4,"testing":100.0,"docs":85.0,"type_safety":60.0,"process":null},"summary":"Code quality is strong: test-to-source ratio 0.62, CI runs tests; 3% of function code in complex or long functions; 1% duplicated lines. Weakest area: type safety."},"security":{"score":79.8,"confidence":0.85,"coverage":1.0,"label":"adequate","breakdown":{"secrets":100.0,"sast":90.1,"dependencies":100.0,"ci_actions":31.7,"posture":40.0,"scorecard":null},"summary":"Security posture is adequate: 8 high-severity SAST findings; 5 high-severity workflow issues. Weakest area: ci actions."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":14.0,"checked":14.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":62.0,"attributed_commits":53.0,"attributed_commit_share":0.8548387096774194,"effective_loc":34482.0,"attributed_loc":4192.0,"attributed_loc_share":0.1215706745548402,"tools_detected":1.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 53 attributed commits, 4,192 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"3c10c9abdd0d7235c57695eb28cc87ebd3e0726d","url":"https://github.com/elthommy/privy-council/commit/3c10c9abdd0d7235c57695eb28cc87ebd3e0726d","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"4015b75c6ed9f8fb2aedfdc2461134d679f1525a","url":"https://github.com/elthommy/privy-council/commit/4015b75c6ed9f8fb2aedfdc2461134d679f1525a","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"4fea7746cba038d1abb057a4be436e298eb5ca95","url":"https://github.com/elthommy/privy-council/commit/4fea7746cba038d1abb057a4be436e298eb5ca95","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"dbcacb9dbd0bff8ef29d126c2bfa92a178b5bbef","url":"https://github.com/elthommy/privy-council/commit/dbcacb9dbd0bff8ef29d126c2bfa92a178b5bbef","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"65a87cd9c922263af3f8dbaad08aefcb4ba7bafe","url":"https://github.com/elthommy/privy-council/commit/65a87cd9c922263af3f8dbaad08aefcb4ba7bafe","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"95aa47a487e7cb2057d5c5f27d09feaf1726ef5d","url":"https://github.com/elthommy/privy-council/commit/95aa47a487e7cb2057d5c5f27d09feaf1726ef5d","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"11fd3d7d91a834df1e61bed1ea174c4cb71b9dcc","url":"https://github.com/elthommy/privy-council/commit/11fd3d7d91a834df1e61bed1ea174c4cb71b9dcc","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"ecf81bc06ca6ba944f0391af1bc6be8eb63ad2c6","url":"https://github.com/elthommy/privy-council/commit/ecf81bc06ca6ba944f0391af1bc6be8eb63ad2c6","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"1c4a02830dd18ec9c23207902ecc4f4310e73a05","url":"https://github.com/elthommy/privy-council/commit/1c4a02830dd18ec9c23207902ecc4f4310e73a05","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"39e44653042008a448ca8c647eb8103643b6fd21","url":"https://github.com/elthommy/privy-council/commit/39e44653042008a448ca8c647eb8103643b6fd21","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"105035dbd3997a778c281be10fc39de4d141b673","url":"https://github.com/elthommy/privy-council/commit/105035dbd3997a778c281be10fc39de4d141b673","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"4a0f4be644787cd0b75c7b55b91900351861b71e","url":"https://github.com/elthommy/privy-council/commit/4a0f4be644787cd0b75c7b55b91900351861b71e","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"d7899d2f537fc9c835e4649d819123b63539ce5e","url":"https://github.com/elthommy/privy-council/commit/d7899d2f537fc9c835e4649d819123b63539ce5e","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"36c3c76e536d42a94404ffe08c069a28631ae326","url":"https://github.com/elthommy/privy-council/commit/36c3c76e536d42a94404ffe08c069a28631ae326","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"8267b6e572f0a1a6cfd2696f50da86c723df31fa","url":"https://github.com/elthommy/privy-council/commit/8267b6e572f0a1a6cfd2696f50da86c723df31fa","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"2e37825a30d12aadfe28e19b118f569aaee7f54c","url":"https://github.com/elthommy/privy-council/commit/2e37825a30d12aadfe28e19b118f569aaee7f54c","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"bd3be11047c242d0c52b6277d4267370ed116fb2","url":"https://github.com/elthommy/privy-council/commit/bd3be11047c242d0c52b6277d4267370ed116fb2","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"ff439aa4514e5b740f6f121330154f7283234249","url":"https://github.com/elthommy/privy-council/commit/ff439aa4514e5b740f6f121330154f7283234249","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"582db0b1ffcbe68c02fac6304135da8cc6832189","url":"https://github.com/elthommy/privy-council/commit/582db0b1ffcbe68c02fac6304135da8cc6832189","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"03553c9345fbcb8abdfda0b22ee64281570e3ce7","url":"https://github.com/elthommy/privy-council/commit/03553c9345fbcb8abdfda0b22ee64281570e3ce7","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"8224d49a494a9b008d36ddce4fc3af6283151a35","url":"https://github.com/elthommy/privy-council/commit/8224d49a494a9b008d36ddce4fc3af6283151a35","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"7301851c6c683137ff1737104280fdf298e79354","url":"https://github.com/elthommy/privy-council/commit/7301851c6c683137ff1737104280fdf298e79354","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"870e121067a55c87cc3f4c401ad5b90cf433a71f","url":"https://github.com/elthommy/privy-council/commit/870e121067a55c87cc3f4c401ad5b90cf433a71f","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"70600e80de73ae7812c3a16d49fc3030fe08bf77","url":"https://github.com/elthommy/privy-council/commit/70600e80de73ae7812c3a16d49fc3030fe08bf77","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"919100d65e5e37cfcb23f588dc481e63eec9506f","url":"https://github.com/elthommy/privy-council/commit/919100d65e5e37cfcb23f588dc481e63eec9506f","weight":0.9}],"data":{"attributed_loc_by_commit":{"189693876a93481029414c7ea9adf809737f886d":0,"2cd8346b8fe127ac3e34d7f4313ffd92e9f45a6f":0,"f5b68aafcb5c1949282969a1c446382424b94424":0,"fffd917ca26cecc3c6033d3c68c63df0e755d2ee":0,"83a9bf6b75d2c1a118ee1a2ec505afbc1cbc0255":0,"f440d1804f959806fe6cc1c0dcd1101d3b8636d0":94,"8d216b6175c3ab2d86913faaddf3f76ce138c86e":193,"4c6b4332fb99c58fc4db24b7346d1f86040158c3":76,"64c559f4d8a89258e27b96d7f582ab68622b3df4":18,"fa3a4da7b0d9e2d34375cad53d01fa0b84a2f0a3":135,"8c4bde7b8c1232d2336e209a3ba25fc0e55facab":40,"4dbb32662217d7d2ea727305317a286ae26beecf":10,"f1243589861fc760df084f56855db08ff6e9bd81":0,"ceeba6dabff3e1a18ca311e18f7ae4cc4a81f478":5,"afa032fc9b4de5aeb90e4024e805bf39c2801648":24,"88b4b9c42cd5e0cc9b2f07457fae717bb32da319":4,"a22f8997bafc09078cca51a242ed6f8c3f051ae9":0,"983019a041a1e494b6add39f6af9fe246080d77c":14,"05f4e24dd27cf3a3d402d67c97a0e2d6f6297175":15,"039cb22032d5647cecb273653e589a6c70e25410":70,"882ab5255be3d7fdc3bb40a1941a3ddf7cc63025":0,"1ef1001a468adc671fa43369e5c4dcb28cdd0c8a":0,"d463e0b6766e6618a5bd2c68d7a1a6739a213662":103,"41b721142c3250316c17fd9a754b428d8c3db942":165,"32afcd0e0290f6b9905d80537997ee635ac9b426":72,"17063b5ed93eb579925f3c627ac9d5f636c8216e":157,"121d92dbe74745e31a1ed6bb834af3d3cbfe57f9":0,"88b06d756fc5dd3224c9502ae3b72589571193ba":0,"70600e80de73ae7812c3a16d49fc3030fe08bf77":450,"919100d65e5e37cfcb23f588dc481e63eec9506f":5,"870e121067a55c87cc3f4c401ad5b90cf433a71f":0,"7301851c6c683137ff1737104280fdf298e79354":343,"8224d49a494a9b008d36ddce4fc3af6283151a35":0,"03553c9345fbcb8abdfda0b22ee64281570e3ce7":68,"582db0b1ffcbe68c02fac6304135da8cc6832189":11,"ff439aa4514e5b740f6f121330154f7283234249":1,"bd3be11047c242d0c52b6277d4267370ed116fb2":59,"2e37825a30d12aadfe28e19b118f569aaee7f54c":6,"36c3c76e536d42a94404ffe08c069a28631ae326":104,"8267b6e572f0a1a6cfd2696f50da86c723df31fa":0,"4a0f4be644787cd0b75c7b55b91900351861b71e":493,"d7899d2f537fc9c835e4649d819123b63539ce5e":4,"105035dbd3997a778c281be10fc39de4d141b673":7,"39e44653042008a448ca8c647eb8103643b6fd21":0,"1c4a02830dd18ec9c23207902ecc4f4310e73a05":64,"11fd3d7d91a834df1e61bed1ea174c4cb71b9dcc":0,"ecf81bc06ca6ba944f0391af1bc6be8eb63ad2c6":74,"95aa47a487e7cb2057d5c5f27d09feaf1726ef5d":631,"dbcacb9dbd0bff8ef29d126c2bfa92a178b5bbef":120,"65a87cd9c922263af3f8dbaad08aefcb4ba7bafe":28,"4fea7746cba038d1abb057a4be436e298eb5ca95":7,"4015b75c6ed9f8fb2aedfdc2461134d679f1525a":298,"3c10c9abdd0d7235c57695eb28cc87ebd3e0726d":224},"tools":{"claude-code":{"name":"Claude Code","commits":53,"loc":4192,"first_seen":1793187003,"last_seen":1794600022}},"monthly":{"2026-10":{"loc":30988,"attributed_loc":698},"2026-11":{"loc":3494,"attributed_loc":3494}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":1.0,"workflow_agents":0.0,"tools_configured":1.0,"earliest_adoption":1793186317.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":"CLAUDE.md (claude-code configuration)","ref":"CLAUDE.md","url":"https://github.com/elthommy/privy-council/blob/c869ce38e8b7b5c45767972f097dda63d8528343/CLAUDE.md","weight":0.5}],"data":{"artifacts":[{"tool":"claude-code","path":"CLAUDE.md","added_at":1793186317}],"workflows":[],"tools":["claude-code"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":22.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":4192.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":242.5704989154013,"median_loc_per_hour":70.75,"pr_timed_units":0.0,"excluded_import_loc":30290.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":["57ced28795659088fab02c5bd25cb309c6a74f93"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":21092.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":9.0,"findings_high":8.0,"findings_medium":1.0,"findings_low":0.0,"weighted_findings":6.25,"scanned_lines":21092.0,"parse_errors":5.0},"findings":[{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/live_session.py","line":163,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/live_session.py:163"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/ollama_import_sharded.py","line":72,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/ollama_import_sharded.py:72"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-asyncio-create-exec-audit","severity":"high","message":"Detected 'create_subprocess_exec' function without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/spike_claude.py","line":76,"fingerprint":"python.lang.security.audit.dangerous-asyncio-create-exec-audit:scripts/spike_claude.py:76"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-asyncio-create-exec-audit","severity":"high","message":"Detected 'create_subprocess_exec' function without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/spike_claude_stream.py","line":50,"fingerprint":"python.lang.security.audit.dangerous-asyncio-create-exec-audit:scripts/spike_claude_stream.py:50"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-asyncio-create-exec-audit","severity":"high","message":"Detected 'create_subprocess_exec' function without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/spike_claude_stream.py","line":86,"fingerprint":"python.lang.security.audit.dangerous-asyncio-create-exec-audit:scripts/spike_claude_stream.py:86"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-asyncio-create-exec-audit","severity":"high","message":"Detected 'create_subprocess_exec' function without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"src/privy_council/backends/claude_cli.py","line":204,"fingerprint":"python.lang.security.audit.dangerous-asyncio-create-exec-audit:src/privy_council/backends/claude_cli.py:204"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-asyncio-create-exec-audit","severity":"high","message":"Detected 'create_subprocess_exec' function without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"src/privy_council/search/container.py","line":45,"fingerprint":"python.lang.security.audit.dangerous-asyncio-create-exec-audit:src/privy_council/search/container.py:45"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-asyncio-create-exec-tainted-env-args","severity":"high","message":"Detected 'create_subprocess_exec' function with user controlled data. You may consider using 'shlex.escape()'. [confidence low]","path":"src/privy_council/search/container.py","line":45,"fingerprint":"python.lang.security.audit.dangerous-asyncio-create-exec-tainted-env-args:src/privy_council/search/container.py:45"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"scripts/spike_ollama.py","line":33,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:scripts/spike_ollama.py:33"}],"evidence":[],"data":{"rulesets":["python","bash"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":0.0,"vulnerabilities":0.0,"vulns_critical":0.0,"vulns_high":0.0,"vulns_medium":0.0,"vulns_low":0.0,"vulns_unknown":0.0,"penalty":0.0},"findings":[],"evidence":[],"data":{"ecosystems":["PyPI"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":1.0,"findings":10.0,"findings_high":5.0,"findings_medium":2.0,"findings_low":3.0,"penalty":68.9},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":20,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:20"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":21,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:21"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":41,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:41"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":62,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:62"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":63,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:63"},{"rule_id":"zizmor/dependabot-cooldown","severity":"medium","message":"insufficient cooldown in Dependabot updates [confidence high]","path":".github/dependabot.yml","line":6,"fingerprint":"dependabot-cooldown:.github/dependabot.yml:6"},{"rule_id":"zizmor/dependabot-cooldown","severity":"medium","message":"insufficient cooldown in Dependabot updates [confidence high]","path":".github/dependabot.yml","line":20,"fingerprint":"dependabot-cooldown:.github/dependabot.yml:20"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":20,"fingerprint":"artipacked:.github/workflows/ci.yml:20"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":41,"fingerprint":"artipacked:.github/workflows/ci.yml:41"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":62,"fingerprint":"artipacked:.github/workflows/ci.yml:62"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":1.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.129,"unpinned_manifests":0.0},"findings":[],"evidence":[{"kind":"posture","description":"Dependency updates: .github/dependabot.yml","ref":".github/dependabot.yml","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":1089.0,"function_nloc":11044.0,"mean_ccn":3.97,"p90_ccn":8.0,"complex_functions":11.0,"long_functions":0.0,"many_param_functions":7.0,"risky_nloc_share":0.0336},"findings":[],"evidence":[{"kind":"complex-function","description":"dispatch in src/privy_council/repl.py: complexity 34, 80 lines","ref":"src/privy_council/repl.py","url":"https://github.com/elthommy/privy-council/blob/c869ce38e8b7b5c45767972f097dda63d8528343/src/privy_council/repl.py#L147","weight":0.5666666666666667},{"kind":"complex-function","description":"_derived in src/privy_council/engine/checks.py: complexity 33, 35 lines","ref":"src/privy_council/engine/checks.py","url":"https://github.com/elthommy/privy-council/blob/c869ce38e8b7b5c45767972f097dda63d8528343/src/privy_council/engine/checks.py#L382","weight":0.55},{"kind":"complex-function","description":"figures in src/privy_council/engine/checks.py: complexity 26, 39 lines","ref":"src/privy_council/engine/checks.py","url":"https://github.com/elthommy/privy-council/blob/c869ce38e8b7b5c45767972f097dda63d8528343/src/privy_council/engine/checks.py#L253","weight":0.43333333333333335},{"kind":"complex-function","description":"_markdown_line in src/privy_council/storage/sessions.py: complexity 26, 36 lines","ref":"src/privy_council/storage/sessions.py","url":"https://github.com/elthommy/privy-council/blob/c869ce38e8b7b5c45767972f097dda63d8528343/src/privy_council/storage/sessions.py#L190","weight":0.43333333333333335},{"kind":"complex-function","description":"score_line in scripts/chair_bench.py: complexity 25, 25 lines","ref":"scripts/chair_bench.py","url":"https://github.com/elthommy/privy-council/blob/c869ce38e8b7b5c45767972f097dda63d8528343/scripts/chair_bench.py#L467","weight":0.4166666666666667},{"kind":"complex-function","description":"_shares in src/privy_council/engine/checks.py: complexity 24, 18 lines","ref":"src/privy_council/engine/checks.py","url":"https://github.com/elthommy/privy-council/blob/c869ce38e8b7b5c45767972f097dda63d8528343/src/privy_council/engine/checks.py#L441","weight":0.4},{"kind":"complex-function","description":"figure_flaws in src/privy_council/engine/checks.py: complexity 22, 49 lines","ref":"src/privy_council/engine/checks.py","url":"https://github.com/elthommy/privy-council/blob/c869ce38e8b7b5c45767972f097dda63d8528343/src/privy_council/engine/checks.py#L708","weight":0.36666666666666664},{"kind":"complex-function","description":"_on_stream_event in src/privy_council/backends/claude_cli.py: complexity 17, 24 lines","ref":"src/privy_council/backends/claude_cli.py","url":"https://github.com/elthommy/privy-council/blob/c869ce38e8b7b5c45767972f097dda63d8528343/src/privy_council/backends/claude_cli.py#L126","weight":0.2833333333333333},{"kind":"complex-function","description":"_columns in src/privy_council/engine/dossier.py: complexity 17, 19 lines","ref":"src/privy_council/engine/dossier.py","url":"https://github.com/elthommy/privy-council/blob/c869ce38e8b7b5c45767972f097dda63d8528343/src/privy_council/engine/dossier.py#L116","weight":0.2833333333333333},{"kind":"complex-function","description":"_add_event in scripts/label_rounds.py: complexity 16, 16 lines","ref":"scripts/label_rounds.py","url":"https://github.com/elthommy/privy-council/blob/c869ce38e8b7b5c45767972f097dda63d8528343/scripts/label_rounds.py#L176","weight":0.26666666666666666}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":16108.0,"duplicated_lines":180.0,"duplicated_share":0.0112,"files":107.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/chair_bench.py:235 and scripts/replay_moderation.py:98","ref":"scripts/chair_bench.py","url":"https://github.com/elthommy/privy-council/blob/c869ce38e8b7b5c45767972f097dda63d8528343/scripts/chair_bench.py#L235","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/live_memory_check.py:83 and src/privy_council/cli.py:379","ref":"scripts/live_memory_check.py","url":"https://github.com/elthommy/privy-council/blob/c869ce38e8b7b5c45767972f097dda63d8528343/scripts/live_memory_check.py#L83","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/replay_moderation.py:158 and scripts/replay_turn.py:110","ref":"scripts/replay_moderation.py","url":"https://github.com/elthommy/privy-council/blob/c869ce38e8b7b5c45767972f097dda63d8528343/scripts/replay_moderation.py#L158","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/replay_notes.py:78 and src/privy_council/engine/memory_flow.py:142","ref":"scripts/replay_notes.py","url":"https://github.com/elthommy/privy-council/blob/c869ce38e8b7b5c45767972f097dda63d8528343/scripts/replay_notes.py#L78","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/spike_claude.py:77 and src/privy_council/backends/claude_cli.py:205","ref":"scripts/spike_claude.py","url":"https://github.com/elthommy/privy-council/blob/c869ce38e8b7b5c45767972f097dda63d8528343/scripts/spike_claude.py#L77","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/privy_council/compare/runner.py:28 and src/privy_council/export/report.py:14","ref":"src/privy_council/compare/runner.py","url":"https://github.com/elthommy/privy-council/blob/c869ce38e8b7b5c45767972f097dda63d8528343/src/privy_council/compare/runner.py#L28","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/privy_council/engine/protocol.py:284 and src/privy_council/engine/protocol.py:302","ref":"src/privy_council/engine/protocol.py","url":"https://github.com/elthommy/privy-council/blob/c869ce38e8b7b5c45767972f097dda63d8528343/src/privy_council/engine/protocol.py#L284","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/privy_council/engine/protocol.py:514 and src/privy_council/engine/review_flow.py:107","ref":"src/privy_council/engine/protocol.py","url":"https://github.com/elthommy/privy-council/blob/c869ce38e8b7b5c45767972f097dda63d8528343/src/privy_council/engine/protocol.py#L514","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/privy_council/engine/resume.py:29 and src/privy_council/export/report.py:16","ref":"src/privy_council/engine/resume.py","url":"https://github.com/elthommy/privy-council/blob/c869ce38e8b7b5c45767972f097dda63d8528343/src/privy_council/engine/resume.py#L29","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/privy_council/export/html.py:13 and src/privy_council/export/markdown.py:10","ref":"src/privy_council/export/html.py","url":"https://github.com/elthommy/privy-council/blob/c869ce38e8b7b5c45767972f097dda63d8528343/src/privy_council/export/html.py#L13","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":13.0,"weighted_findings":25.0,"scanned_lines":21092.0,"category:best-practice":3.0,"category:correctness":2.0,"category:maintainability":8.0},"findings":[{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"scripts/live_session.py","line":135,"fingerprint":"python.lang.best-practice.arbitrary-sleep:scripts/live_session.py:135"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"scripts/live_session.py","line":153,"fingerprint":"python.lang.best-practice.arbitrary-sleep:scripts/live_session.py:153"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"scripts/num_batch_bench.py","line":59,"fingerprint":"python.lang.best-practice.arbitrary-sleep:scripts/num_batch_bench.py:59"},{"rule_id":"opengrep/python.lang.maintainability.useless-inner-function","severity":"high","message":"function `ask` is defined inside a function but never used","path":"src/privy_council/chat/discord_bot.py","line":260,"fingerprint":"python.lang.maintainability.useless-inner-function:src/privy_council/chat/discord_bot.py:260"},{"rule_id":"opengrep/python.lang.maintainability.useless-inner-function","severity":"high","message":"function `run` is defined inside a function but never used","path":"src/privy_council/chat/discord_bot.py","line":271,"fingerprint":"python.lang.maintainability.useless-inner-function:src/privy_council/chat/discord_bot.py:271"},{"rule_id":"opengrep/python.lang.maintainability.useless-inner-function","severity":"high","message":"function `handover` is defined inside a function but never used","path":"src/privy_council/chat/discord_bot.py","line":280,"fingerprint":"python.lang.maintainability.useless-inner-function:src/privy_council/chat/discord_bot.py:280"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"scripts/label_rounds.py","line":214,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:scripts/label_rounds.py:214"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"src/privy_council/compare/store.py","line":59,"fingerprint":"python.lang.maintainability.return-not-in-function:src/privy_council/compare/store.py:59"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"src/privy_council/engine/budget.py","line":61,"fingerprint":"python.lang.maintainability.return-not-in-function:src/privy_council/engine/budget.py:61"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"src/privy_council/models/research.py","line":32,"fingerprint":"python.lang.maintainability.return-not-in-function:src/privy_council/models/research.py:32"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"src/privy_council/repl.py","line":130,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:src/privy_council/repl.py:130"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_running\" a function or an attribute? If it is a function, you may have meant w.is_running() because w.is_running is always true.","path":"src/privy_council/tui/app.py","line":312,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:src/privy_council/tui/app.py:312"},{"rule_id":"opengrep/python.lang.maintainability.is-function-without-parentheses","severity":"medium","message":"Is \"is_empty\" a function or an attribute? If it is a function, you may have meant self.selection.is_empty() because self.selection.is_empty is always true.","path":"src/privy_council/tui/widgets.py","line":460,"fingerprint":"python.lang.maintainability.is-function-without-parentheses:src/privy_council/tui/widgets.py:460"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":1.0,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":1.0,"check:tests_cochange":1.0,"test_lines":12988.0,"source_lines":21092.0,"test_ratio":0.6158,"ci_files":1.0,"cochange_share":0.8182,"cochange_commits":33.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/ci.yml","ref":".github/workflows/ci.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (pytest)","ref":null,"url":null,"weight":0.0},{"kind":"ci","description":"CI runs linters (ruff, pre-commit)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["pytest"],"lint_commands":["ruff","pre-commit"]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":1.0,"readme_lines":255.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0},{"kind":"docs","description":"CHANGELOG.md","ref":"CHANGELOG.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":1.0,"check:low_escape_density":0.0,"escapes":167.0,"escapes_per_kloc":7.942},"findings":[],"evidence":[{"kind":"typing","description":"Python strict type checking: pyproject.toml","ref":"pyproject.toml","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":2603.0,"other_lines":18489.0,"files_blamed":107.0,"blame_failures":0.0,"quality:ai_findings":4.0,"quality:ai_per_kloc":1.537,"quality:other_findings":9.0,"quality:other_per_kloc":0.487,"quality:ratio":3.16,"security:ai_findings":0.0,"security:ai_per_kloc":0.0,"security:other_findings":9.0,"security:other_per_kloc":0.487,"security:ratio":0.0},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":true},"error":null}],"flags":[]}