2.7

Adjusted Signal

2.7

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

20.8K

Stars

Rust

Language

1.0M

Lines of Code

1.9K

Files

1.9K

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 6.9/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 1436 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.7/100 · LOW

Are imports declared and package/API names verified? 116 finding(s).

Agent Over-Engineering Ratio 7.0/100 · LOW

Are wrappers, guards, and repeated structures necessary? 751 finding(s).

PR Review Velocity Impact 12.4/100 · LOW

Which changes need focused human review? 1925 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 1HIGH 7MEDIUM 377LOW 1540

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 1925 distinct pattern matches across 20 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Decorative Section Separators348 hits · 1150 pts

Severity	File	Line	Snippet	Context
MEDIUM	tasks/vm.toml	15	# ═══════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM	tasks/vm.toml	17	# ═══════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM	tasks/scripts/keycloak-k8s-setup.sh	54	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tasks/scripts/keycloak-k8s-setup.sh	56	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tasks/scripts/keycloak-k8s-setup.sh	109	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tasks/scripts/keycloak-k8s-setup.sh	111	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	tasks/scripts/keycloak-k8s-setup.sh	210	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	tasks/scripts/keycloak-k8s-setup.sh	212	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	tasks/scripts/keycloak-k8s-setup.sh	217	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	tasks/scripts/keycloak-k8s-setup.sh	219	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	tasks/scripts/sandbox.sh	18	# -------------------------------------------------------------------	COMMENT
MEDIUM⚡	tasks/scripts/sandbox.sh	20	# -------------------------------------------------------------------	COMMENT
MEDIUM⚡	tasks/scripts/sandbox.sh	28	# -------------------------------------------------------------------	COMMENT
MEDIUM⚡	tasks/scripts/sandbox.sh	30	# -------------------------------------------------------------------	COMMENT
MEDIUM⚡	tasks/scripts/sandbox.sh	37	# -------------------------------------------------------------------	COMMENT
MEDIUM⚡	tasks/scripts/sandbox.sh	39	# -------------------------------------------------------------------	COMMENT
MEDIUM	tasks/scripts/sandbox.sh	59	# -------------------------------------------------------------------	COMMENT
MEDIUM	tasks/scripts/sandbox.sh	61	# -------------------------------------------------------------------	COMMENT
MEDIUM	tasks/scripts/docker-publish-multiarch.sh	28	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tasks/scripts/docker-publish-multiarch.sh	30	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tasks/scripts/docker-publish-multiarch.sh	77	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tasks/scripts/docker-publish-multiarch.sh	79	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tasks/scripts/docker-publish-multiarch.sh	140	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tasks/scripts/docker-publish-multiarch.sh	142	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	tasks/scripts/container-engine.sh	320	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	tasks/scripts/container-engine.sh	325	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	tasks/scripts/container-engine.sh	334	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	tasks/scripts/container-engine.sh	336	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	tasks/scripts/container-engine.sh	341	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	tasks/scripts/container-engine.sh	349	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	tasks/scripts/container-engine.sh	445	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	tasks/scripts/container-engine.sh	450	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	tasks/scripts/container-engine.sh	459	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	tasks/scripts/container-engine.sh	466	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tasks/scripts/container-engine.sh	36	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tasks/scripts/container-engine.sh	38	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tasks/scripts/container-engine.sh	231	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tasks/scripts/container-engine.sh	233	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tasks/scripts/container-engine.sh	248	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tasks/scripts/container-engine.sh	260	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tasks/scripts/container-engine.sh	387	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tasks/scripts/container-engine.sh	394	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tasks/scripts/container-engine.sh	406	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tasks/scripts/container-engine.sh	411	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tasks/scripts/container-engine.sh	427	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tasks/scripts/container-engine.sh	433	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tasks/scripts/container-engine.sh	511	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tasks/scripts/container-engine.sh	516	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tasks/scripts/package-deb.sh	67	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tasks/scripts/package-deb.sh	69	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tasks/scripts/package-deb.sh	108	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tasks/scripts/package-deb.sh	110	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tasks/scripts/package-deb.sh	122	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tasks/scripts/package-deb.sh	124	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tasks/scripts/package-deb.sh	140	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tasks/scripts/package-deb.sh	142	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tasks/scripts/package-deb.sh	165	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tasks/scripts/package-deb.sh	167	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tasks/scripts/vm/download-kernel-runtime.sh	33	# ── Auto-detect platform (detect_platform from _lib.sh) ─────────────────	COMMENT
MEDIUM	tasks/scripts/vm/download-kernel-runtime.sh	72	# ── Check for gh CLI ────────────────────────────────────────────────────	COMMENT
288 more matches not shown…

Over-Commented Block876 hits · 852 pts

Severity	File	Line	Snippet	Context
LOW	buf.yaml	1	# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.	COMMENT
LOW	.packit.yaml	21	# upstream tag, avoiding operational tags such as vm-dev; Packit normalizes	COMMENT
LOW	tasks/vm.toml	1	# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.	COMMENT
LOW	tasks/scripts/verify-static-binary.sh	1	#!/usr/bin/env bash	COMMENT
LOW	tasks/scripts/verify-static-binary.sh	21	# damaged ELF, which naive parsing would read as "no interpreter, no	COMMENT
LOW	tasks/scripts/verify-defaults-without-telemetry.sh	1	#!/usr/bin/env bash	COMMENT
LOW	tasks/scripts/verify-telemetry-compiled-out.sh	1	#!/usr/bin/env bash	COMMENT
LOW	tasks/scripts/keycloak-k8s-setup.sh	1	#!/usr/bin/env bash	COMMENT
LOW	tasks/scripts/sandbox.sh	1	#!/usr/bin/env bash	COMMENT
LOW	tasks/scripts/container-engine.sh	1	#!/usr/bin/env bash	COMMENT
LOW	tasks/scripts/container-engine.sh	21	#	COMMENT
LOW	tasks/scripts/container-engine.sh	241	[[ "${CONTAINER_ENGINE}" == "podman" ]]	COMMENT
LOW	tasks/scripts/container-engine.sh	461	#	COMMENT
LOW	tasks/scripts/run-postgres-tests.sh	1	#!/usr/bin/env bash	COMMENT
LOW	tasks/scripts/package-deb.sh	1	#!/usr/bin/env bash	COMMENT
LOW	tasks/scripts/package-deb-install.sh	1	#!/usr/bin/env bash	COMMENT
LOW	tasks/scripts/gateway.sh	1	#!/usr/bin/env bash	COMMENT
LOW	tasks/scripts/gateway-docker.sh	1	#!/usr/bin/env bash	COMMENT
LOW	tasks/scripts/gateway-podman.sh	1	#!/usr/bin/env bash	COMMENT
LOW	tasks/scripts/gateway-vm.sh	1	#!/usr/bin/env bash	COMMENT
LOW	tasks/scripts/gateway-vm.sh	21	# OPENSHELL_SERVER_PORT=18091 mise run gateway:vm	COMMENT
LOW	tasks/scripts/helm-k3s-local.sh	1	#!/usr/bin/env bash	COMMENT
LOW	tasks/scripts/build-env.sh	1	#!/usr/bin/env bash	COMMENT
LOW	tasks/scripts/vm/download-kernel-runtime.sh	1	#!/usr/bin/env bash	COMMENT
LOW	tasks/scripts/vm/compress-vm-runtime.sh	1	#!/usr/bin/env bash	COMMENT
LOW	tasks/scripts/vm/build-libkrun-macos.sh	1	#!/usr/bin/env bash	COMMENT
LOW	tasks/scripts/vm/_lib.sh	1	#!/usr/bin/env bash	COMMENT
LOW	tasks/scripts/vm/package-vm-runtime.sh	1	#!/usr/bin/env bash	COMMENT
LOW	tasks/scripts/vm/vm-setup.sh	1	#!/usr/bin/env bash	COMMENT
LOW	tasks/scripts/vm/smoke-orphan-cleanup.sh	1	#!/usr/bin/env bash	COMMENT
LOW	tasks/scripts/vm/build-libkrun.sh	1	#!/usr/bin/env bash	COMMENT
LOW	tasks/scripts/vm/build-libkrun.sh	161	#	COMMENT
LOW	…s/openshell-driver-mxc/tests/policy_mapper_examples.rs	1	// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.	COMMENT
LOW	crates/openshell-driver-mxc/tests/wxc_exec_real.rs	1	// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.	COMMENT
LOW	…tes/openshell-driver-mxc/tests/policy_mapper_matrix.rs	1	// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.	COMMENT
LOW	…tes/openshell-driver-mxc/tests/policy_mapper_matrix.rs	1061		COMMENT
LOW	crates/openshell-driver-mxc/examples/demo.yaml	1	# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.	COMMENT
LOW	crates/openshell-driver-mxc/examples/demo.yaml	21		COMMENT
LOW	crates/openshell-driver-mxc/examples/mxc-gateway.toml	1	# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.	COMMENT
LOW	…ates/openshell-driver-mxc/examples/mxc-ocsf-audit.toml	1	# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.	COMMENT
LOW	crates/openshell-driver-mxc/examples/ocsf-audit.yaml	1	# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.	COMMENT
LOW	…enshell-driver-mxc/examples/e2e-policies/fs-empty.yaml	1	# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.	COMMENT
LOW	…l-driver-mxc/examples/e2e-policies/network-reject.yaml	1	# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.	COMMENT
LOW	crates/openshell-driver-mxc/src/policy.rs	1	// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.	COMMENT
LOW	crates/openshell-driver-mxc/src/policy.rs	21		COMMENT
LOW	crates/openshell-driver-mxc/src/lib.rs	1	// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.	COMMENT
LOW	crates/openshell-driver-mxc/src/lib.rs	21	mod grpc;	COMMENT
LOW	crates/openshell-driver-mxc/src/etw_consumer.rs	1	// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.	COMMENT
LOW	crates/openshell-driver-mxc/src/etw_consumer.rs	21	//! (`msft-mxc/src/tools/mxc_diagnostic_console/src/etw.rs`), trimmed to Plane A	COMMENT
LOW	crates/openshell-driver-mxc/src/etw_consumer.rs	81	// ---------------------------------------------------------------------------	COMMENT
LOW	crates/openshell-driver-mxc/src/etw_consumer.rs	141	// Neutral decoded event (the capture/decode → attribute/map seam)	COMMENT
LOW	crates/openshell-driver-mxc/src/etw_consumer.rs	161	/// before decode).	COMMENT
LOW	crates/openshell-driver-mxc/src/etw_consumer.rs	181	/// [`DecodedEtwEvent::summary`] for sanitized diagnostic output.	COMMENT
LOW	crates/openshell-driver-mxc/src/etw_consumer.rs	261	.collect();	COMMENT
LOW	crates/openshell-driver-mxc/src/etw_consumer.rs	1161	.join(" ");	COMMENT
LOW	crates/openshell-driver-mxc/src/etw_consumer.rs	1181	/// - command text never establishes ownership, and the PID anchor is retired as	COMMENT
LOW	crates/openshell-driver-mxc/src/etw_consumer.rs	1881	.to_string()	COMMENT
LOW	crates/openshell-driver-mxc/src/mxc.rs	41	}	COMMENT
LOW	crates/openshell-driver-mxc/src/driver.rs	41	/// policy — it has no deny primitive and is NOT default-deny.	COMMENT
LOW	crates/openshell-driver-mxc/src/driver.rs	61	pub struct MxcComputeConfig {	COMMENT
816 more matches not shown…

Hyper-Verbose Identifiers375 hits · 306 pts

Severity	File	Line	Snippet	Context
LOW	TESTING.md	139	def test_exec_python_serializes_callable_payload() -> None:	CODE
LOW	tasks/scripts/sync_docs_website.py	201	def seed_mutable_snapshot_metadata(	CODE
LOW	tasks/scripts/sync_docs_website.py	220	def ensure_immutable_snapshot(	CODE
LOW	tasks/scripts/sync_docs_website.py	240	def ensure_monotonic_snapshot(	CODE
LOW	tasks/scripts/sync_docs_website.py	434	def source_version_announcement(docs_yml: Path, slug: str) -> YamlMapping \| None:	CODE
LOW	tasks/scripts/codex_security_range_test.py	78	def test_parses_strict_stable_and_prerelease_tags() -> None:	CODE
LOW	tasks/scripts/codex_security_range_test.py	91	def test_selects_the_newest_stable_strictly_before_the_candidate_train() -> None:	CODE
LOW	tasks/scripts/codex_security_range_test.py	97	def test_resolves_a_cumulative_prerelease_range_from_git_history(repo: Path) -> None:	CODE
LOW	tasks/scripts/codex_security_range_test.py	116	def test_rejects_a_candidate_that_is_not_a_prerelease_tag(repo: Path) -> None:	CODE
LOW	tasks/scripts/codex_security_range_test.py	126	def test_rejects_a_prerelease_that_is_not_on_main(repo: Path) -> None:	CODE
LOW	tasks/scripts/codex_security_range_test.py	140	def test_requires_explicit_approval_before_a_full_bootstrap_scan(repo: Path) -> None:	CODE
LOW	tasks/scripts/codex_security_range_test.py	156	def test_rejects_a_stable_override_newer_than_the_train(repo: Path) -> None:	CODE
LOW	tasks/scripts/codex_security_range_test.py	167	def test_cli_writes_github_outputs_and_json(repo: Path, tmp_path: Path) -> None:	CODE
LOW	tasks/scripts/codex_security_range_test.py	186	def test_cli_fails_without_bootstrap_approval(repo: Path) -> None:	CODE
LOW	tasks/scripts/release.py	165	def _versions_from_prerelease(	CODE
LOW	tasks/scripts/release.py	495	def generate_homebrew_formula(	STRING
LOW⚡	tasks/scripts/check_maintainer_approval_test.py	41	def test_parse_maintainers_extracts_linked_logins() -> None:	STRING
LOW⚡	tasks/scripts/check_maintainer_approval_test.py	45	def test_parse_maintainers_ignores_unlinked_mentions() -> None:	STRING
LOW⚡	tasks/scripts/check_maintainer_approval_test.py	51	def test_comment_after_approval_does_not_revoke_it() -> None:	STRING
LOW⚡	tasks/scripts/check_maintainer_approval_test.py	56	def test_dismissed_review_revokes_approval() -> None:	STRING
LOW⚡	tasks/scripts/check_maintainer_approval_test.py	61	def test_changes_requested_after_approval_revokes_it() -> None:	STRING
LOW⚡	tasks/scripts/check_maintainer_approval_test.py	66	def test_out_of_order_reviews_still_respect_the_latest_position() -> None:	STRING
LOW⚡	tasks/scripts/check_maintainer_approval_test.py	76	def test_exits_zero_when_a_maintainer_approved(tmp_path) -> None:	STRING
LOW⚡	tasks/scripts/check_maintainer_approval_test.py	80	def test_matches_logins_case_insensitively(tmp_path) -> None:	STRING
LOW⚡	tasks/scripts/check_maintainer_approval_test.py	84	def test_exits_nonzero_with_no_reviews(tmp_path) -> None:	STRING
LOW⚡	tasks/scripts/check_maintainer_approval_test.py	89	def test_exits_nonzero_on_non_maintainer_approval(tmp_path) -> None:	STRING
LOW⚡	tasks/scripts/check_maintainer_approval_test.py	93	def test_fails_closed_on_unparseable_list(tmp_path) -> None:	STRING
LOW⚡	tasks/scripts/alert_maintainer_change_test.py	37	def test_parse_maintainers_extracts_linked_logins() -> None:	CODE
LOW⚡	tasks/scripts/alert_maintainer_change_test.py	41	def test_names_added_and_removed_logins() -> None:	CODE
LOW⚡	tasks/scripts/alert_maintainer_change_test.py	51	def test_says_nothing_when_only_prose_moves() -> None:	CODE
LOW⚡	tasks/scripts/alert_maintainer_change_test.py	56	def test_prints_nothing_when_the_approver_set_is_unchanged(	CODE
LOW⚡	tasks/scripts/alert_maintainer_change_test.py	63	def test_fails_when_the_result_parses_empty(tmp_path, monkeypatch, capsys) -> None:	CODE
LOW⚡	tasks/scripts/alert_maintainer_change_test.py	69	def test_fails_when_the_marker_is_unset(tmp_path, monkeypatch) -> None:	CODE
LOW⚡	tasks/scripts/alert_maintainer_change_test.py	73	def test_body_starts_with_the_marker_the_workflow_supplies(	CODE
LOW⚡	tasks/scripts/alert_maintainer_change_test.py	82	def test_login_pattern_matches_the_gate() -> None:	CODE
LOW	tasks/scripts/check_docs_nav_test.py	47	def test_fern_slug_splits_camel_case() -> None:	STRING
LOW	tasks/scripts/check_docs_nav_test.py	78	def test_label_url_that_differs_from_file_path_fails(tmp_path: Path) -> None:	STRING
LOW	tasks/scripts/check_docs_nav_test.py	97	def test_frontmatter_slug_can_pin_the_url_to_the_file_path(tmp_path: Path) -> None:	STRING
LOW	tasks/scripts/check_docs_nav_test.py	113	def test_sidebar_name_must_match_nav_label(tmp_path: Path) -> None:	STRING
LOW	tasks/scripts/check_docs_nav_test.py	172	def test_skip_slug_omits_navigation_level(tmp_path: Path, nav: str, rel: str) -> None:	STRING
LOW	tasks/scripts/check_docs_nav_test.py	177	def test_skip_slug_detects_url_that_differs_from_file_path(tmp_path: Path) -> None:	STRING
LOW	tasks/scripts/check_docs_nav_test.py	196	def test_folder_pages_use_file_names_and_orphans_fail(tmp_path: Path) -> None:	STRING
LOW	tasks/scripts/check_docs_nav_test.py	225	def test_dev_redirects_must_point_to_live_pages(	STRING
LOW	tasks/scripts/check_maintainer_approval.py	41	def parse_reviews_to_approvers(reviews: list[dict]) -> set[str]:	CODE
LOW	tasks/scripts/codex_security_diagnostics_test.py	23	def test_public_report_omits_sensitive_text_and_preserves_exit(tmp_path, exit_code):	CODE
LOW	tasks/scripts/codex_security_diagnostics_test.py	82	def test_scanner_output_does_not_exhaust_file_size_limit(tmp_path):	CODE
LOW	tasks/scripts/codex_security_diagnostics_test.py	110	def test_unknown_enum_values_are_not_published(tmp_path, value):	CODE
LOW	tasks/scripts/codex_security_diagnostics_test.py	121	def test_missing_invalid_and_symlinked_reports_do_not_echo_contents(tmp_path):	CODE
LOW	tasks/scripts/codex_security_diagnostics_test.py	139	def test_fifo_report_does_not_block_diagnostics(tmp_path, filename, field):	CODE
LOW	tasks/scripts/codex_security_diagnostics_test.py	168	def test_scan_output_directory_stays_empty_until_scanner_writes(tmp_path):	CODE
LOW	tasks/scripts/check_cargo_lockfile_alignment_test.py	36	def test_reports_shared_registry_crates_at_other_versions(tmp_path: Path) -> None:	CODE
LOW	tasks/scripts/check_cargo_lockfile_alignment_test.py	65	def test_aligned_lockfiles_pass(tmp_path: Path) -> None:	CODE
LOW⚡	tasks/scripts/sync_docs_website_test.py	102	def test_resolve_slug_channels() -> None:	CODE
LOW⚡	tasks/scripts/sync_docs_website_test.py	109	def test_resolve_slug_version_requires_slug() -> None:	CODE
LOW⚡	tasks/scripts/sync_docs_website_test.py	114	def test_resolve_slug_rejects_unsafe_characters() -> None:	CODE
LOW⚡	tasks/scripts/sync_docs_website_test.py	122	def test_resolve_display_name() -> None:	CODE
LOW	tasks/scripts/sync_docs_website_test.py	31	def test_release_workflows_sync_and_publish_docs_once() -> None:	CODE
LOW	tasks/scripts/sync_docs_website_test.py	78	def test_sync_workflow_serializes_sync_and_publish() -> None:	CODE
LOW	tasks/scripts/sync_docs_website_test.py	133	def test_resolve_availability() -> None:	CODE
LOW	tasks/scripts/sync_docs_website_test.py	141	def test_parse_and_render_versions_preserves_version_settings() -> None:	CODE
315 more matches not shown…

Structural Annotation Overuse85 hits · 127 pts

Severity	File	Line	Snippet	Context
LOW⚡	.packit.yaml	26	# Step 1: Create source tarball from git working tree.	COMMENT
LOW⚡	.packit.yaml	30	# Step 2: Create vendored Cargo dependencies tarball for offline RPM build.	COMMENT
LOW⚡	.packit.yaml	32	# Step 3: Return the primary archive name. Packit expects create-archive	COMMENT
LOW	crates/openshell-cli/src/oidc_auth.rs	343	// Step 1: Request device and user codes	COMMENT
LOW	crates/openshell-cli/src/oidc_auth.rs	380	// Step 2: Display instructions to the user	COMMENT
LOW	crates/openshell-cli/src/oidc_auth.rs	394	// Step 3: Poll the token endpoint	COMMENT
LOW⚡	crates/openshell-tui/src/lib.rs	1019	// Step 6: Cancel log stream and pause event handler before suspending.	COMMENT
LOW⚡	crates/openshell-tui/src/lib.rs	1026	// Step 7: Suspend TUI — leave alternate screen, disable raw mode.	COMMENT
LOW⚡	crates/openshell-tui/src/lib.rs	1035	// Step 8: Spawn SSH as child process and wait.	COMMENT
LOW	crates/openshell-tui/src/lib.rs	871	// Step 1: Fetch sandbox metadata (providers, sandbox ID).	COMMENT
LOW	crates/openshell-tui/src/lib.rs	894	// Step 2: Fetch the current live policy (includes updates since creation).	COMMENT
LOW	crates/openshell-tui/src/lib.rs	978	// Step 3: Resolve gateway address (handle loopback override).	COMMENT
LOW	crates/openshell-tui/src/lib.rs	989	// Step 4: Build the ProxyCommand using our own binary.	COMMENT
LOW	crates/openshell-tui/src/lib.rs	1005	// Step 5: Build the SSH command.	COMMENT
LOW	crates/openshell-tui/src/lib.rs	1052	// Step 9: Resume and draw the TUI before accepting new terminal input.	COMMENT
LOW	crates/openshell-tui/src/lib.rs	1109	// Step 2: Resolve gateway and build ProxyCommand (same as handle_shell_connect).	COMMENT
LOW	crates/openshell-tui/src/lib.rs	1136	// Step 3: Build SSH command — same flags as handle_shell_connect but with	COMMENT
LOW	crates/openshell-tui/src/lib.rs	1153	// Step 4: Suspend TUI.	COMMENT
LOW	crates/openshell-tui/src/lib.rs	1167	// Step 5: Run command — blocks until user Ctrl-C's or command exits.	COMMENT
LOW	crates/openshell-tui/src/lib.rs	1184	// Step 6: Resume TUI.	COMMENT
LOW	crates/openshell-server/src/supervisor_session.rs	2521	// Step 1: Wait for SupervisorHello.	COMMENT
LOW	crates/openshell-server/src/grpc/policy.rs	17545	// Step 1: mechanistic submits a broad L4 grant; the prover flags it	COMMENT
LOW	crates/openshell-server/src/grpc/policy.rs	17610	// Step 2: the agent refines into a narrow L7 proposal for the SAME	COMMENT
LOW	deploy/helm/openshell/values.yaml	568	# WARNING: The RBAC Role grants read/write access to ALL Secrets in the	COMMENT
LOW	.agents/skills/update-docs/SKILL.md	24	## Step 1: Identify Relevant Commits	COMMENT
LOW	.agents/skills/update-docs/SKILL.md	47	## Step 2: Map Commits to Doc Pages	COMMENT
LOW	.agents/skills/update-docs/SKILL.md	70	## Step 3: Read the Commit Details	COMMENT
LOW	.agents/skills/update-docs/SKILL.md	85	## Step 4: Read the Current Doc Page	COMMENT
LOW	.agents/skills/update-docs/SKILL.md	95	## Step 5: Draft the Update	COMMENT
LOW	.agents/skills/update-docs/SKILL.md	132	## Step 6: Present the Results	COMMENT
LOW	.agents/skills/update-docs/SKILL.md	151	## Step 7: Build and Verify	COMMENT
LOW	.agents/skills/launch-openshell-gator/SKILL.md	42	### Step 1: Confirm Repository Root	COMMENT
LOW	.agents/skills/launch-openshell-gator/SKILL.md	51	### Step 2: Verify Required Host Tools	COMMENT
LOW	.agents/skills/launch-openshell-gator/SKILL.md	62	### Step 3: Verify GitHub Auth	COMMENT
LOW	.agents/skills/launch-openshell-gator/SKILL.md	73	### Step 4: Verify Codex Auth For Codex Harness	COMMENT
LOW	.agents/skills/launch-openshell-gator/SKILL.md	101	### Step 5: Verify Gateway Is Registered And Alive	COMMENT
LOW	.agents/skills/launch-openshell-gator/SKILL.md	117	### Step 6: Check Existing Gator Sandboxes	COMMENT
LOW	.agents/skills/review-github-pr/SKILL.md	17	## Step 1: Resolve the PR	COMMENT
LOW	.agents/skills/review-github-pr/SKILL.md	37	## Step 2: Fetch PR Description	COMMENT
LOW	.agents/skills/review-github-pr/SKILL.md	64	## Step 3: Generate the Diff	COMMENT
LOW	.agents/skills/review-github-pr/SKILL.md	99	## Step 4: Analyze and Summarize	COMMENT
LOW	.agents/skills/review-github-pr/SKILL.md	159	## Step 5: Output	COMMENT
LOW⚡	scripts/docker-cleanup.sh	155	# Step 1: Remove dangling (untagged) images	COMMENT
LOW⚡	scripts/docker-cleanup.sh	174	# Step 2: Remove stale tagged images	COMMENT
LOW⚡	scripts/docker-cleanup.sh	218	# Step 3: Remove unused volumes	COMMENT
LOW⚡	scripts/docker-cleanup.sh	255	# Step 4: Prune build cache	COMMENT
LOW⚡	scripts/docker-cleanup.sh	271	# Step 5: Clean up any newly-dangling images left after tagged image removal	COMMENT
LOW	scripts/agents/gator/skills/gator-gate/SKILL.md	342	## Step 1: Fetch Context	COMMENT
LOW	scripts/agents/gator/skills/gator-gate/SKILL.md	368	## Step 2: Recover From Current State	COMMENT
LOW	scripts/agents/gator/skills/gator-gate/SKILL.md	447	## Step 3: Check Process Blockers	COMMENT
LOW	scripts/agents/gator/skills/gator-gate/SKILL.md	464	## Step 4: Duplicate Detection	COMMENT
LOW	scripts/agents/gator/skills/gator-gate/SKILL.md	494	## Step 5: Auto-Validation	COMMENT
LOW	scripts/agents/gator/skills/gator-gate/SKILL.md	507	## Step 6: Validate Issues and PRs	COMMENT
LOW	scripts/agents/gator/skills/gator-gate/SKILL.md	600	## Step 7: Follow-Up TTL	COMMENT
LOW	scripts/agents/gator/skills/gator-gate/SKILL.md	620	## Step 8: PR Review Loop	COMMENT
LOW	scripts/agents/gator/skills/gator-gate/SKILL.md	925	## Step 9: E2E and Test Label Decision	COMMENT
LOW	scripts/agents/gator/skills/gator-gate/SKILL.md	981	## Step 10: Pipeline Watch Loop	COMMENT
LOW	scripts/agents/gator/skills/gator-gate/SKILL.md	1013	## Step 11: Approval Needed	COMMENT
LOW	scripts/agents/gator/skills/gator-gate/SKILL.md	1035	## Step 12: Merge Ready	COMMENT
LOW	skills/debug-openshell-cluster/SKILL.md	56	### Step 1: Check CLI Reachability	COMMENT
25 more matches not shown…

Unused Imports76 hits · 69 pts

Severity	File	Line	Context
LOW	tasks/scripts/sync_docs_website.py	13	CODE
LOW	tasks/scripts/codex_security_range_test.py	4	CODE
LOW	tasks/scripts/select-release-candidate.py	8	CODE
LOW	tasks/scripts/release.py	6	CODE
LOW	tasks/scripts/codex_security_range.py	13	CODE
LOW	tasks/scripts/verify-python-wheel.py	6	CODE
LOW	tasks/scripts/check_maintainer_approval_test.py	11	CODE
LOW	tasks/scripts/alert_maintainer_change_test.py	11	CODE
LOW	tasks/scripts/check_docs_nav_test.py	4	CODE
LOW	tasks/scripts/check_maintainer_approval.py	15	CODE
LOW	tasks/scripts/codex_security_diagnostics_test.py	4	CODE
LOW	tasks/scripts/next-prerelease-tag.py	8	CODE
LOW	tasks/scripts/check_docs_nav.py	32	CODE
LOW	tasks/scripts/check_cargo_lockfile_alignment_test.py	6	CODE
LOW	tasks/scripts/codex_security_diagnostics.py	7	CODE
LOW	tasks/scripts/alert_maintainer_change.py	19	CODE
LOW	tasks/scripts/sync_docs_website_test.py	11	CODE
LOW	tasks/scripts/check_cargo_lockfile_alignment.py	25	CODE
LOW	python/release_tooling_test.py	4	CODE
LOW	python/wheel_verifier_test.py	4	CODE
LOW	python/openshell/rpm_gateway_config_migration_test.py	4	CODE
LOW	python/openshell/__init__.py	6	CODE
LOW	python/openshell/__init__.py	8	CODE
LOW	python/openshell/__init__.py	8	CODE
LOW	python/openshell/__init__.py	8	CODE
LOW	python/openshell/__init__.py	8	CODE
LOW	python/openshell/__init__.py	9	CODE
LOW	python/openshell/__init__.py	9	CODE
LOW	python/openshell/__init__.py	10	CODE
LOW	python/openshell/__init__.py	10	CODE
LOW	python/openshell/__init__.py	11	CODE
LOW	python/openshell/__init__.py	11	CODE
LOW	python/openshell/__init__.py	11	CODE
LOW	python/openshell/__init__.py	11	CODE
LOW	python/openshell/__init__.py	11	CODE
LOW	python/openshell/__init__.py	11	CODE
LOW	python/openshell/__init__.py	11	CODE
LOW	python/openshell/__init__.py	11	CODE
LOW	python/openshell/__init__.py	11	CODE
LOW	python/openshell/__init__.py	11	CODE
LOW	python/openshell/__init__.py	11	CODE
LOW	python/openshell/__init__.py	11	CODE
LOW	python/openshell/__init__.py	11	CODE
LOW	python/openshell/__init__.py	11	CODE
LOW	python/openshell/__init__.py	11	CODE
LOW	python/openshell/__init__.py	11	CODE
LOW	python/openshell/__init__.py	11	CODE
LOW	python/openshell/__init__.py	11	CODE
LOW	python/openshell/__init__.py	11	CODE
LOW	python/openshell/providers.py	6	CODE
LOW	python/openshell/release_formula_test.py	4	CODE
LOW	python/openshell/gateway_config_fixture_test.py	6	CODE
LOW	python/openshell/errors.py	6	CODE
LOW	deploy/sbom/sbom_to_csv.py	13	CODE
LOW	deploy/sbom/resolve_licenses_test.py	4	CODE
LOW	deploy/sbom/resolve_licenses.py	21	CODE
LOW	examples/policy-advisor/ctf.py	22	CODE
LOW	examples/transparent-tcp-redis/redis_client.py	6	CODE
LOW	scripts/update_license_headers.py	19	CODE
LOW	scripts/baseline_workflow_metrics.py	23	CODE
16 more matches not shown…

AI Slop Vocabulary20 hits · 63 pts

Severity	File	Line	Snippet	Context
MEDIUM	tasks/scripts/test-e2e-image-overrides.sh	115	# harness must propagate the gateway registry there too, including an empty	COMMENT
MEDIUM	crates/openshell-sandbox/src/network_broker.rs	239	#[cfg(any(test, feature = "perf-harness"))]	COMMENT
MEDIUM	crates/openshell-sandbox/src/lib.rs	25	#[cfg(all(target_os = "linux", feature = "perf-harness"))]	COMMENT
MEDIUM⚡	deploy/helm/openshell/ci/values-openshift-e2e.yaml	4	# OpenShift overlay for the Kubernetes e2e harness.	COMMENT
MEDIUM⚡	deploy/helm/openshell/ci/values-openshift-e2e.yaml	6	# Bundles the OpenShift-specific settings the harness needs: the Route/mTLS	COMMENT
MEDIUM⚡	deploy/helm/openshell/ci/values-openshift-e2e.yaml	10	# `sandbox connect` path (round-trip-heavy SSH over SPDY), so the harness drives	COMMENT
MEDIUM⚡	deploy/helm/openshell/ci/values-openshift-e2e.yaml	19	# ci/values-openshift-scc.yaml when an OpenShift cluster is detected. The harness	COMMENT
MEDIUM	deploy/helm/openshell/ci/values-tls-port-forward.yaml	5	# that require it, such as the shared supervisor. The harness reaches the	COMMENT
MEDIUM	deploy/helm/openshell/ci/values-openshift-scc.yaml	9	# The e2e Kubernetes harness applies this automatically when it detects an	COMMENT
MEDIUM	scripts/agents/run.sh	95	[[ $# -ge 2 ]] \|\| fail "--harness requires a value"	CODE
MEDIUM	scripts/agents/run.sh	214	abort "unsupported harness: #{harness} (supported: #{supported.keys.join(', ')})" unless supported.key?(harness)	CODE
MEDIUM	scripts/agents/run.sh	621	# Compile tooling references only. Task, harness, and supervision settings are	COMMENT
MEDIUM	scripts/agents/runtime/supervisor.sh	53	# The harness receives the assembled instructions on stdin, not through its	COMMENT
MEDIUM	scripts/lint-mermaid/package-lock.json	1697	"resolved": "https://registry.npmjs.org/robust-predicates/-/robust-predicates-3.0.3.tgz",	CODE
MEDIUM	e2e/with-podman-gateway.sh	23	# Podman sandbox stop timeout. The harness default is intentionally shorter	COMMENT
MEDIUM	e2e/with-kube-gateway.sh	24	# OpenShift the harness reaches the gateway through a normal network path: a	COMMENT
MEDIUM	e2e/with-kube-gateway.sh	169	# the harness, before port-forwards are established, because replacing a pod	COMMENT
MEDIUM	e2e/with-kube-gateway.sh	783	# kubeconfig this harness uses.	COMMENT
MEDIUM	e2e/with-kube-gateway.sh	1618	# kubeconfig this harness uses.	COMMENT
MEDIUM	e2e/mcp-conformance/client-through-openshell.sh	9	# script with that URL. The parent harness creates one reusable conformance	COMMENT

Fake / Example Data36 hits · 42 pts

Severity	File	Line	Snippet	Context
LOW	crates/openshell-cli/tests/cli_help_integration.rs	172	"/tmp/fake-key",	CODE
LOW	crates/openshell-server/src/grpc/provider.rs	14823	"placeholder".to_string(),	CODE
LOW	crates/openshell-server/src/grpc/provider.rs	15255	"placeholder".to_string(),	CODE
LOW	crates/openshell-server/src/grpc/provider.rs	15466	"placeholder".to_string(),	CODE
LOW	crates/openshell-supervisor-network/src/l7/relay.rs	5989	.expect("placeholder")	CODE
LOW	crates/openshell-supervisor-network/src/l7/relay.rs	6093	.expect("placeholder")	CODE
LOW	crates/openshell-supervisor-network/src/l7/relay.rs	9640	.expect("placeholder")	CODE
LOW	sdk/go/openshell/v1/workspace_test.go	315	PrincipalSubject: "user@example.com",	CODE
LOW⚡	sdk/go/openshell/v1/workspace_test.go	328	m, err := wc.AddMember(context.Background(), "test-ws", "user@example.com", WorkspaceRoleAdmin)	CODE
LOW⚡	sdk/go/openshell/v1/workspace_test.go	332	assert.Equal(t, "user@example.com", m.PrincipalSubject)	CODE
LOW⚡	sdk/go/openshell/v1/workspace_test.go	335	assert.Equal(t, "user@example.com", mock.lastAddMemberReq.GetPrincipalSubject())	CODE
LOW⚡	sdk/go/openshell/v1/workspace_test.go	344	_, err := wc.AddMember(context.Background(), "", "user@example.com", WorkspaceRoleAdmin)	CODE
LOW	sdk/go/openshell/v1/workspace_test.go	368	_, err := wc.AddMember(context.Background(), "test-ws", "user@example.com", WorkspaceRole("invalid"))	CODE
LOW	sdk/go/openshell/v1/workspace_test.go	382	_, err := wc.AddMember(context.Background(), "test-ws", "user@example.com", WorkspaceRoleUser)	CODE
LOW	sdk/go/openshell/v1/workspace_test.go	396	_, err := wc.RemoveMember(context.Background(), "test-ws", "user@example.com")	CODE
LOW	sdk/go/openshell/v1/workspace_test.go	407	_, err := wc.RemoveMember(context.Background(), "", "user@example.com")	CODE
LOW	sdk/go/openshell/v1/workspace_test.go	453	assert.Equal(t, "user@example.com", members[0].PrincipalSubject)	CODE
LOW	…k/go/openshell/v1/internal/converter/workspace_test.go	122	PrincipalSubject: "user@example.com",	CODE
LOW	…k/go/openshell/v1/internal/converter/workspace_test.go	134	assert.Equal(t, "user@example.com", m.PrincipalSubject)	CODE
LOW⚡	sdk/go/openshell/v1/fake/workspace_test.go	146	m, err := fc.Workspaces().AddMember(context.Background(), "ws", "user@example.com", types.WorkspaceRoleAdmin)	CODE
LOW⚡	sdk/go/openshell/v1/fake/workspace_test.go	150	assert.Equal(t, "user@example.com", m.PrincipalSubject)	CODE
LOW⚡	sdk/go/openshell/v1/fake/workspace_test.go	156	_, err := fc.Workspaces().AddMember(context.Background(), "", "user@example.com", types.WorkspaceRoleAdmin)	CODE
LOW⚡	sdk/go/openshell/v1/fake/workspace_test.go	172	_, err := fc.Workspaces().AddMember(context.Background(), "ws", "user@example.com", types.WorkspaceRole("invalid"))	CODE
LOW⚡	sdk/go/openshell/v1/fake/workspace_test.go	180	_, err := fc.Workspaces().AddMember(context.Background(), "ws", "user@example.com", types.WorkspaceRoleAdmin)	CODE
LOW⚡	sdk/go/openshell/v1/fake/workspace_test.go	183	_, err = fc.Workspaces().AddMember(context.Background(), "ws", "user@example.com", types.WorkspaceRoleUser)	CODE
LOW⚡	sdk/go/openshell/v1/fake/workspace_test.go	190	_, _ = fc.Workspaces().AddMember(context.Background(), "ws", "user@example.com", types.WorkspaceRoleAdmin)	CODE
LOW⚡	sdk/go/openshell/v1/fake/workspace_test.go	192	_, err := fc.Workspaces().RemoveMember(context.Background(), "ws", "user@example.com")	CODE
LOW⚡	sdk/go/openshell/v1/fake/workspace_test.go	202	_, err := fc.Workspaces().RemoveMember(context.Background(), "", "user@example.com")	CODE
LOW	sdk/go/openshell/v1/fake/workspace_test.go	244	_, _ = fc.Workspaces().AddMember(context.Background(), "ws-a", "user@example.com", types.WorkspaceRoleAdmin)	CODE
LOW	sdk/go/openshell/v1/fake/workspace_test.go	250	assert.Equal(t, "user@example.com", membersA[0].PrincipalSubject)	CODE
LOW	sdk/go/openshell/v1/fake/health.go	78	Subject: "fake-user",	CODE
LOW	sdk/go/openshell/v1/fake/health_test.go	110	assert.Equal(t, "fake-user", user.Subject)	CODE
LOW	examples/multi-agent-notepad/runner.sh	86	"placeholder",	CODE
LOW	…amples/agent-driven-policy-management/sandbox-agent.sh	44	"placeholder",	CODE
LOW	scripts/agents/runtime/harnesses/codex/exec_test.sh	56	GITHUB_TOKEN="placeholder" \	CODE
LOW	scripts/agents/runtime/harnesses/codex/exec.sh	52	"placeholder",	CODE

Verbosity Indicators28 hits · 42 pts

Severity	File	Line	Snippet	Context
LOW⚡	.packit.yaml	26	# Step 1: Create source tarball from git working tree.	COMMENT
LOW⚡	.packit.yaml	30	# Step 2: Create vendored Cargo dependencies tarball for offline RPM build.	COMMENT
LOW⚡	.packit.yaml	32	# Step 3: Return the primary archive name. Packit expects create-archive	COMMENT
LOW	crates/openshell-cli/src/oidc_auth.rs	343	// Step 1: Request device and user codes	COMMENT
LOW	crates/openshell-cli/src/oidc_auth.rs	380	// Step 2: Display instructions to the user	COMMENT
LOW	crates/openshell-cli/src/oidc_auth.rs	394	// Step 3: Poll the token endpoint	COMMENT
LOW⚡	crates/openshell-tui/src/lib.rs	1019	// Step 6: Cancel log stream and pause event handler before suspending.	COMMENT
LOW⚡	crates/openshell-tui/src/lib.rs	1026	// Step 7: Suspend TUI — leave alternate screen, disable raw mode.	COMMENT
LOW⚡	crates/openshell-tui/src/lib.rs	1035	// Step 8: Spawn SSH as child process and wait.	COMMENT
LOW	crates/openshell-tui/src/lib.rs	871	// Step 1: Fetch sandbox metadata (providers, sandbox ID).	COMMENT
LOW	crates/openshell-tui/src/lib.rs	894	// Step 2: Fetch the current live policy (includes updates since creation).	COMMENT
LOW	crates/openshell-tui/src/lib.rs	978	// Step 3: Resolve gateway address (handle loopback override).	COMMENT
LOW	crates/openshell-tui/src/lib.rs	989	// Step 4: Build the ProxyCommand using our own binary.	COMMENT
LOW	crates/openshell-tui/src/lib.rs	1005	// Step 5: Build the SSH command.	COMMENT
LOW	crates/openshell-tui/src/lib.rs	1052	// Step 9: Resume and draw the TUI before accepting new terminal input.	COMMENT
LOW	crates/openshell-tui/src/lib.rs	1109	// Step 2: Resolve gateway and build ProxyCommand (same as handle_shell_connect).	COMMENT
LOW	crates/openshell-tui/src/lib.rs	1136	// Step 3: Build SSH command — same flags as handle_shell_connect but with	COMMENT
LOW	crates/openshell-tui/src/lib.rs	1153	// Step 4: Suspend TUI.	COMMENT
LOW	crates/openshell-tui/src/lib.rs	1167	// Step 5: Run command — blocks until user Ctrl-C's or command exits.	COMMENT
LOW	crates/openshell-tui/src/lib.rs	1184	// Step 6: Resume TUI.	COMMENT
LOW	crates/openshell-server/src/supervisor_session.rs	2521	// Step 1: Wait for SupervisorHello.	COMMENT
LOW	crates/openshell-server/src/grpc/policy.rs	17545	// Step 1: mechanistic submits a broad L4 grant; the prover flags it	COMMENT
LOW	crates/openshell-server/src/grpc/policy.rs	17610	// Step 2: the agent refines into a narrow L7 proposal for the SAME	COMMENT
LOW⚡	scripts/docker-cleanup.sh	155	# Step 1: Remove dangling (untagged) images	COMMENT
LOW⚡	scripts/docker-cleanup.sh	174	# Step 2: Remove stale tagged images	COMMENT
LOW⚡	scripts/docker-cleanup.sh	218	# Step 3: Remove unused volumes	COMMENT
LOW⚡	scripts/docker-cleanup.sh	255	# Step 4: Prune build cache	COMMENT
LOW⚡	scripts/docker-cleanup.sh	271	# Step 5: Clean up any newly-dangling images left after tagged image removal	COMMENT

Self-Referential Comments7 hits · 22 pts

Severity	File	Line	Snippet	Context
MEDIUM	tasks/scripts/vm/build-libkrun-macos.sh	149	# Create the unversioned symlink that libkrun links against	COMMENT
MEDIUM	…enshell-driver-vm/scripts/openshell-vm-sandbox-init.sh	560	# Create a virtiofs mount point under ROOT_PREFIX without following symlinks,	COMMENT
MEDIUM	python/openshell/rpm_gateway_config_migration_test.py	18	# This file is seeded to ~/.config/openshell/gateway.toml on first start	COMMENT
MEDIUM	deploy/docker/gateway.toml	6	# This file is the primary configuration source for docker-compose.yml in this	COMMENT
MEDIUM⚡	scripts/smoke-test-network-policy.sh	134	# Create a sandbox with a sleep, wait for Ready (sandboxes are kept by default).	COMMENT
MEDIUM	e2e/with-kube-gateway.sh	13	# Create a local k3d cluster via tasks/scripts/helm-k3s-local.sh, install	COMMENT
MEDIUM	e2e/rust/tests/rootfs_tar.rs	26	# Create the sandbox user/group so the supervisor can switch to it.	COMMENT

Cross-Language Confusion3 hits · 22 pts

Severity	File	Line	Snippet	Context
HIGH⚡	e2e/python/test_sandbox_api.py	152	"[ -t 0 ] && printf T \|\| printf N; "	CODE
HIGH⚡	e2e/python/test_sandbox_api.py	153	"[ -t 1 ] && printf T \|\| printf N; "	CODE
HIGH⚡	e2e/python/test_sandbox_api.py	154	"[ -t 2 ] && printf T \|\| printf N; "	CODE

Example Usage Blocks15 hits · 21 pts

Severity	File	Line	Snippet	Context
LOW	tasks/sbom.toml	6	# Usage:	COMMENT
LOW	tasks/notices.toml	6	# Usage:	COMMENT
LOW	tasks/scripts/keycloak-k8s-setup.sh	12	# Usage:	COMMENT
LOW	tasks/scripts/package-deb-install.sh	15	# Usage:	COMMENT
LOW	tasks/scripts/vm/download-kernel-runtime.sh	12	# Usage:	COMMENT
LOW	tasks/scripts/vm/compress-vm-runtime.sh	11	# Usage:	COMMENT
LOW	tasks/scripts/vm/build-libkrun-macos.sh	22	# Usage:	COMMENT
LOW	tasks/scripts/vm/package-vm-runtime.sh	12	# Usage:	COMMENT
LOW	tasks/scripts/vm/vm-setup.sh	13	# Usage:	COMMENT
LOW	tasks/scripts/vm/build-libkrun.sh	20	# Usage:	COMMENT
LOW⚡	scripts/smoke-test-network-policy.sh	17	# Usage:	COMMENT
LOW	scripts/keycloak-dev.sh	6	# Usage:	COMMENT
LOW	scripts/docker-cleanup.sh	15	# Usage:	COMMENT
LOW	scripts/test-release-tag.sh	8	# Usage:	COMMENT
LOW	e2e/rust/e2e-vm.sh	17	# Usage:	COMMENT

Excessive Try-Catch Wrapping19 hits · 20 pts

Severity	File	Line	Snippet	Context
LOW	tasks/scripts/sync_docs_website.py	685	except Exception as exc:	CODE
MEDIUM	tasks/scripts/sync_docs_website.py	678	def main() -> None:	CODE
LOW	python/openshell/__init__.py	37	except Exception:	CODE
LOW	python/openshell/sandbox.py	448	except Exception:	CODE
LOW	examples/policy-advisor/ctf.py	213	except Exception as exc: # noqa: BLE001	CODE
LOW	examples/policy-advisor/ctf.py	258	except Exception as exc: # noqa: BLE001	CODE
LOW	scripts/agents/runtime/supervisor.sh	96	except Exception:	CODE
LOW	e2e/rust/tests/otlp_relay.rs	70	except Exception as error:	CODE
LOW	e2e/rust/tests/provider_readiness.rs	150	except Exception as error:	CODE
LOW	e2e/rust/tests/stable_external_placeholders.rs	181	except Exception as error:	CODE
LOW	e2e/rust/tests/podman_corporate_proxy.rs	344	except Exception as err:	CODE
LOW	e2e/rust/tests/vm_corporate_proxy.rs	413	except Exception as err:	CODE
LOW	e2e/rust/tests/live_internet_traffic_perf.rs	90	except Exception as error:	CODE
LOW	e2e/rust/tests/additional_ca.rs	1203	except Exception:	CODE
LOW	e2e/rust/tests/ocsf_jsonl_conformance.rs	35	except Exception:	CODE
LOW	e2e/rust/tests/docker_corporate_proxy.rs	497	except Exception as err:	CODE
LOW	e2e/rust/tests/docker_corporate_proxy.rs	535	except Exception as err:	CODE
LOW	e2e/rust/tests/forward_proxy_l7_bypass.rs	119	except Exception as e:	CODE
LOW	e2e/rust/tests/forward_proxy_l7_bypass.rs	163	except Exception as e:	CODE

Deep Nesting22 hits · 19 pts

Severity	File	Line	Context
LOW	tasks/scripts/select-release-candidate.py	63	CODE
LOW	tasks/scripts/release.py	246	CODE
LOW	tasks/scripts/release.py	592	CODE
LOW	tasks/scripts/check_docs_nav.py	92	CODE
LOW	tasks/scripts/codex_security_diagnostics.py	79	CODE
LOW	python/openshell/errors_test.py	46	CODE
LOW	python/openshell/rpm_gateway_config_migration_test.py	175	CODE
LOW	python/openshell/sandbox.py	1999	CODE
LOW	python/openshell/sandbox.py	364	CODE
LOW	python/openshell/sandbox.py	1252	CODE
LOW	python/openshell/sandbox.py	1771	CODE
LOW	python/openshell/errors.py	41	CODE
LOW	deploy/sbom/resolve_licenses.py	400	CODE
LOW	examples/policy-advisor/ctf.py	388	CODE
LOW	e2e/python/test_sandbox_providers.py	344	CODE
LOW	e2e/python/test_sandbox_providers.py	557	CODE
LOW	e2e/python/test_sandbox_providers.py	641	CODE
LOW	e2e/python/test_sandbox_providers.py	728	CODE
LOW	e2e/python/test_exec_admission.py	87	CODE
LOW	e2e/python/test_sandbox_api.py	135	CODE
LOW	e2e/python/test_sandbox_api.py	219	CODE
LOW	e2e/python/test_sandbox_api.py	144	CODE

Empty Error Handlers3 hits · 15 pts

Severity	File	Line	Snippet	Context
HIGH	tasks/scripts/codex_security_diagnostics.py	39	except (OSError, ValueError, RecursionError):	CODE
HIGH	…amples/supervisor-middleware-content-guard/upstream.py	25	except KeyboardInterrupt:	CODE
HIGH	e2e/python/test_sandbox_providers.py	1159	except grpc.RpcError:	CODE

Hallucination Indicators1 hit · 10 pts

Severity	File	Line	Snippet	Context
CRITICAL	python/openshell/sandbox.py	1970	template.spec.workload.resources.gpu.SetInParent()	CODE

Synthetic Comment Markers1 hit · 8 pts

Severity	File	Line	Snippet	Context
HIGH	crates/openshell-sdk/src/provider_readiness.rs	28	/// The original receipt's authority was installed or revoked as requested.	COMMENT

Redundant / Tautological Comments3 hits · 4 pts

Severity	File	Line	Snippet	Context
LOW	e2e/with-podman-gateway.sh	22	# Set OPENSHELL_E2E_PODMAN_STOP_TIMEOUT_SECS to override the managed gateway's	COMMENT
LOW	e2e/with-kube-gateway.sh	31	# Set OPENSHELL_E2E_KUBE_EXTRA_VALUES to one or more colon-separated Helm values	COMMENT
LOW	e2e/with-kube-gateway.sh	56	# Set OPENSHELL_E2E_KUBE_EXTERNAL_POSTGRES_SECRET to create an ephemeral	COMMENT

Modern Structural Boilerplate3 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	tasks/scripts/sync_docs_website.py	459	def update_docs_yml(docs_yml: Path, updated: VersionEntry, fern_dir: Path) -> None:	CODE
LOW	python/openshell/__init__.py	40	__all__ = [	CODE
LOW	deploy/sbom/resolve_licenses.py	337	def set_license(comp: dict, license_id: str) -> None:	CODE

Modern AI Meta-Vocabulary1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	providers/github.yaml	37	# writes require an explicit policy proposal so the agentic loop +	COMMENT

AI Structural Patterns3 hits · 2 pts

Severity	File	Line	Context
LOW	python/openshell/sandbox.py	1935	CODE
LOW	python/openshell/sandbox.py	1389	CODE
LOW	python/openshell/sandbox.py	1644	CODE

NVIDIA/OpenShell

Open-Source Code Quality, Security and Technical Debt Review