2.5

Adjusted Signal

2.5

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

4.9K

Stars

Language

693.4K

Lines of Code

1.9K

Files

1.3K

Pattern Hits

2026-10-31

Scan Date

0.01

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 9.1/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 1080 finding(s).

Hallucinated Dependency & Supply Chain Risk 1.6/100 · LOW

Are imports declared and package/API names verified? 126 finding(s).

Agent Over-Engineering Ratio 2.2/100 · LOW

Are wrappers, guards, and repeated structures necessary? 224 finding(s).

PR Review Velocity Impact 11.2/100 · LOW

Which changes need focused human review? 1273 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 26MEDIUM 120LOW 1127

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 1273 distinct pattern matches across 17 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block602 hits · 590 pts

Severity	File	Line	Snippet	Context
LOW	.mergify.yml	1	queue_rules:	COMMENT
LOW	.mergify.yml	61	# Evaluated against the speculative draft PR. Intentionally omitted:	COMMENT
LOW	.mergify.yml	81	# 2026-04-21 (removal 2026-07-01); the published migration path is	COMMENT
LOW	supported-versions.txt	1	# Currency floor for the printing-press generation skills.	COMMENT
LOW	cmd/manifest-gen/main.go	1	// manifest-gen downloads an OpenAPI/internal spec and generates a tools-manifest.json.	COMMENT
LOW	…n-loop-api/learn-loop-example/internal/learn/recall.go	41	// SourcePattern marks a Hit synthesized by the pattern substitution	COMMENT
LOW	…n-loop-api/learn-loop-example/internal/learn/recall.go	81	//	COMMENT
LOW	…n-loop-api/learn-loop-example/internal/learn/recall.go	121	// Opts tunes Recall behavior. Zero-value defaults:	COMMENT
LOW	…n-loop-api/learn-loop-example/internal/learn/recall.go	241	// Ambiguous-alias warning surfaces only when a SINGLE query entity	COMMENT
LOW	…n-loop-api/learn-loop-example/internal/learn/recall.go	361		COMMENT
LOW	…n-loop-api/learn-loop-example/internal/learn/recall.go	381	// caught at that layer.	COMMENT
LOW	…n-loop-api/learn-loop-example/internal/learn/recall.go	401	// structural overlap >= crossAliasMin:	COMMENT
LOW	…n-loop-api/learn-loop-example/internal/learn/recall.go	601	fmt.Sprintf("%s:%s (run sync to refresh entity lookups)", TopWarningLookupRefreshAvailable, e))	COMMENT
LOW	…n-loop-api/learn-loop-example/internal/learn/recall.go	921	// live here too).	COMMENT
LOW	…n-loop-api/learn-loop-example/internal/learn/recall.go	1261	)	COMMENT
LOW	…-loop-api/learn-loop-example/internal/learn/journal.go	61	journalClassStr = "str"	COMMENT
LOW	…n-loop-api/learn-loop-example/internal/learn/derive.go	21		COMMENT
LOW	…n-loop-api/learn-loop-example/internal/learn/derive.go	81	// DeriveFlagCorrections runs one bounded tail scan of the invocation	COMMENT
LOW	…n-loop-api/learn-loop-example/internal/learn/derive.go	101	// the closest such flag by edit distance when multiple were added;	COMMENT
LOW	…op-api/learn-loop-example/internal/learn/synthesize.go	21	// SynthesizePlaybookCandidate turns that episode into a quarantined	COMMENT
LOW	…op-api/learn-loop-example/internal/learn/synthesize.go	101	steps []PlaybookStep	COMMENT
LOW	…op-api/learn-loop-example/internal/learn/synthesize.go	221	}	COMMENT
LOW	…api/learn-loop-example/internal/learn/lookups/seeds.go	1	// Copyright 2026 printing-press-golden and contributors. Licensed under Apache-2.0. See LICENSE.	COMMENT
LOW	…api/learn-loop-example/internal/learn/lookups/seeds.go	21	type SeedConfig struct {	COMMENT
LOW	…pi/learn-loop-example/internal/learn/patterns/apply.go	21	// coherent: direct hits and pattern hits both pass through the same	COMMENT
LOW	…pi/learn-loop-example/internal/learn/patterns/apply.go	41	ResourceEntities []string	COMMENT
LOW	…pi/learn-loop-example/internal/learn/patterns/apply.go	61	type Opts struct {	COMMENT
LOW	…/learn-loop-example/internal/learn/entities/extract.go	1	// Copyright 2026 printing-press-golden and contributors. Licensed under Apache-2.0. See LICENSE.	COMMENT
LOW	…/learn-loop-example/internal/learn/entities/extract.go	21	// Config.RegisterTickerPattern. Kept separate from Entities so	COMMENT
LOW	…/learn-loop-example/internal/learn/entities/extract.go	41	// 1. Token matches any Config.tickerPatterns -> Tickers	COMMENT
LOW	…-api/learn-loop-example/internal/cli/teach_playbook.go	1	// Copyright 2026 printing-press-golden. Licensed under Apache-2.0. See LICENSE.	COMMENT
LOW	…loop-api/learn-loop-example/internal/cli/learn_init.go	1	// Copyright 2026 printing-press-golden and contributors. Licensed under Apache-2.0. See LICENSE.	COMMENT
LOW	…earn-loop-api/learn-loop-example/internal/cli/teach.go	1	// Copyright 2026 printing-press-golden and contributors. Licensed under Apache-2.0. See LICENSE.	COMMENT
LOW	…earn-loop-api/learn-loop-example/internal/cli/teach.go	541	// them to teach.log without failing the surrounding resource learning.	COMMENT
LOW	…earn-loop-example/internal/cli/learnings_candidates.go	1	// Copyright 2026 printing-press-golden and contributors. Licensed under Apache-2.0. See LICENSE.	COMMENT
LOW	…learn-loop-api/learn-loop-example/internal/cli/root.go	201	if idx := strings.Index(msg, "unknown flag: "); idx >= 0 {	COMMENT
LOW	…learn-loop-api/learn-loop-example/internal/cli/root.go	281	// substring "required flag" or "invalid argument" doesn't get	COMMENT
LOW	…learn-loop-api/learn-loop-example/internal/cli/root.go	601	return true	COMMENT
LOW	…rn-loop-api/learn-loop-example/internal/store/store.go	41	}	COMMENT
LOW	…rn-loop-api/learn-loop-example/internal/store/store.go	61	// (CJK substring search), v10's learn_candidates and learn_events tables	COMMENT
LOW	…rn-loop-api/learn-loop-example/internal/store/store.go	101	return OpenWithContext(context.Background(), dbPath)	COMMENT
LOW	…rn-loop-api/learn-loop-example/internal/store/store.go	121	// delete mode (e.g. a pre-WAL database opened by an old binary before its	COMMENT
LOW	…rn-loop-api/learn-loop-example/internal/store/store.go	501	// Must run before the migrations slice so that subsequent CREATE INDEX	COMMENT
LOW	…rn-loop-api/learn-loop-example/internal/store/store.go	601	// CLI Printing Press: learn migrations	COMMENT
LOW	…rn-loop-api/learn-loop-example/internal/store/store.go	641	value TEXT NOT NULL,	COMMENT
LOW	…rn-loop-api/learn-loop-example/internal/store/store.go	681	// see learn.QueryFamily). One row per family holds the optional	COMMENT
LOW	…rn-loop-api/learn-loop-example/internal/store/store.go	701	ingress_surface TEXT NOT NULL DEFAULT 'cli',	COMMENT
LOW	…rn-loop-api/learn-loop-example/internal/store/store.go	761	}	COMMENT
LOW	…rn-loop-api/learn-loop-example/internal/store/store.go	821	// rowids that were derived from those keys.	COMMENT
LOW	…rn-loop-api/learn-loop-example/internal/store/store.go	2561	var resourceIDFieldOverrides = map[string]string{	COMMENT
LOW	…rn-loop-api/learn-loop-example/internal/store/store.go	2761	// - A container (object/array) is never replaced by a scalar or null.	COMMENT
LOW	…rn-loop-api/learn-loop-example/internal/store/store.go	3261	// BareResourceID strips the NUL-delimited parent suffix that resourceStorageID	COMMENT
LOW	…rn-loop-api/learn-loop-example/internal/store/store.go	3301	continue	COMMENT
LOW	…rn-loop-api/learn-loop-example/internal/store/store.go	3801	// printing-press repo) for the child path's placeholder.	COMMENT
LOW	…n-loop-api/learn-loop-example/internal/store/events.go	61		COMMENT
LOW	…n-loop-api/learn-loop-example/internal/store/events.go	221	RecallMisses int64	COMMENT
LOW	…oop-api/learn-loop-example/internal/store/learnings.go	301	// the same normalization at both write (teach) and read (recall + apply)	COMMENT
LOW	…oop-api/learn-loop-example/internal/store/learnings.go	341	//	COMMENT
LOW	…oop-api/learn-loop-example/internal/store/learnings.go	781		COMMENT
LOW	…oop-api/learn-loop-example/internal/store/learnings.go	801	RemoveHit(resourceType, resourceID string)	COMMENT
542 more matches not shown…

Structural Annotation Overuse131 hits · 218 pts

Severity	File	Line	Snippet	Context
LOW	…ed/generate-learn-loop-api/learn-loop-example/SKILL.md	206	### Step 2: decision tree	COMMENT
LOW	…ed/generate-learn-loop-api/learn-loop-example/SKILL.md	257	### Step 3: always read `warnings`	COMMENT
LOW	…ed/generate-learn-loop-api/learn-loop-example/SKILL.md	282	### Step 5: playbooks - optional flags, automatic synthesis	COMMENT
LOW	…h-doctor/additional-auth-doctor/internal/cli/doctor.go	382	// Step 1: Basic reachability via the configured transport.	COMMENT
LOW	…h-doctor/additional-auth-doctor/internal/cli/doctor.go	426	// Step 2: Validate credentials with an authenticated probe.	COMMENT
LOW	…lit-token-auth/split-token-auth/internal/cli/doctor.go	383	// Step 1: Basic reachability via the configured transport.	COMMENT
LOW	…lit-token-auth/split-token-auth/internal/cli/doctor.go	427	// Step 2: Validate credentials with an authenticated probe.	COMMENT
LOW	…ookie-auth/golden-api-cookie-auth/internal/cli/auth.go	141	// Step 0: Try press-auth, the dedicated cookie capture companion.	COMMENT
LOW	…ookie-auth/golden-api-cookie-auth/internal/cli/auth.go	180	// Step 1: Detect cookie extraction tool	COMMENT
LOW	…ookie-auth/golden-api-cookie-auth/internal/cli/auth.go	203	// Step 2: Resolve which Chrome profile to use when the backend can honor it	COMMENT
LOW	…ookie-auth/golden-api-cookie-auth/internal/cli/auth.go	226	// Step 3: Extract cookies from the resolved profile	COMMENT
LOW	…ookie-auth/golden-api-cookie-auth/internal/cli/auth.go	268	// Step 5: Save to config	COMMENT
LOW	…ss-openapi/keyless-leftover-env/internal/cli/doctor.go	295	// Step 1: Basic reachability via the configured transport.	COMMENT
LOW	…ss-openapi/keyless-leftover-env/internal/cli/doctor.go	339	// Step 2: Validate credentials with an authenticated probe.	COMMENT
LOW	…keyless-openapi/keyless-openapi/internal/cli/doctor.go	295	// Step 1: Basic reachability via the configured transport.	COMMENT
LOW	…keyless-openapi/keyless-openapi/internal/cli/doctor.go	339	// Step 2: Validate credentials with an authenticated probe.	COMMENT
LOW	…routing-api/tier-routing-golden/internal/cli/doctor.go	379	// Step 1: Basic reachability via the configured transport.	COMMENT
LOW	…routing-api/tier-routing-golden/internal/cli/doctor.go	423	// Step 2: Validate credentials with an authenticated probe.	COMMENT
LOW	…ted/generate-golden-api/printing-press-golden/SKILL.md	224	### Step 2: decision tree	COMMENT
LOW	…ted/generate-golden-api/printing-press-golden/SKILL.md	275	### Step 3: always read `warnings`	COMMENT
LOW	…ted/generate-golden-api/printing-press-golden/SKILL.md	300	### Step 5: playbooks - optional flags, automatic synthesis	COMMENT
LOW	…olden-api/printing-press-golden/internal/cli/doctor.go	357	// Step 1: Basic reachability via the configured transport.	COMMENT
LOW	…olden-api/printing-press-golden/internal/cli/doctor.go	401	// Step 2: Validate credentials with an authenticated probe.	COMMENT
LOW	…golden-api-rich-auth/printing-press-rich-auth/SKILL.md	189	### Step 2: decision tree	COMMENT
LOW	…golden-api-rich-auth/printing-press-rich-auth/SKILL.md	240	### Step 3: always read `warnings`	COMMENT
LOW	…golden-api-rich-auth/printing-press-rich-auth/SKILL.md	265	### Step 5: playbooks - optional flags, automatic synthesis	COMMENT
LOW	…h-auth/printing-press-rich-auth/internal/cli/doctor.go	409	// Step 1: Basic reachability via the configured transport.	COMMENT
LOW	…h-auth/printing-press-rich-auth/internal/cli/doctor.go	453	// Step 2: Validate credentials with an authenticated probe.	COMMENT
LOW	…device-code/printing-press-oauth2-device-code/SKILL.md	192	### Step 2: decision tree	COMMENT
LOW	…device-code/printing-press-oauth2-device-code/SKILL.md	243	### Step 3: always read `warnings`	COMMENT
LOW	…device-code/printing-press-oauth2-device-code/SKILL.md	268	### Step 5: playbooks - optional flags, automatic synthesis	COMMENT
LOW	…nerate-public-param-names/public-param-golden/SKILL.md	182	### Step 2: decision tree	COMMENT
LOW	…nerate-public-param-names/public-param-golden/SKILL.md	233	### Step 3: always read `warnings`	COMMENT
LOW	…nerate-public-param-names/public-param-golden/SKILL.md	258	### Step 5: playbooks - optional flags, automatic synthesis	COMMENT
LOW⚡	internal/pipeline/research.go	267	// Step 3: Deduplicate by URL	COMMENT
LOW⚡	internal/pipeline/research.go	270	// Step 4: Score novelty and produce recommendation	COMMENT
LOW⚡	internal/pipeline/research.go	274	// Step 5: Analyze gaps and patterns	COMMENT
LOW	internal/pipeline/research.go	325	// Step 6: Write research.json	COMMENT
LOW⚡	internal/pipeline/workflow_manifest_test.go	60	// Step 0: stores find_stores	COMMENT
LOW⚡	internal/pipeline/workflow_manifest_test.go	69	// Step 1: menu get_menu	COMMENT
LOW⚡	internal/pipeline/workflow_manifest_test.go	76	// Step 2: cart new	COMMENT
LOW⚡	internal/pipeline/workflow_manifest_test.go	83	// Step 3: cart add ${item_code}	COMMENT
LOW⚡	internal/pipeline/workflow_manifest_test.go	88	// Step 4: orders price_order	COMMENT
LOW⚡	internal/pipeline/fullrun.go	26	// Step 1: Research	COMMENT
LOW⚡	internal/pipeline/fullrun.go	30	// Step 2: Generate	COMMENT
LOW⚡	internal/pipeline/fullrun.go	38	// Step 3: Coverage	COMMENT
LOW⚡	internal/pipeline/fullrun.go	45	// Step 4: Dogfood	COMMENT
LOW⚡	internal/pipeline/fullrun.go	58	// Step 5: Scorecard	COMMENT
LOW⚡	internal/pipeline/fullrun.go	62	// Step 6: Learnings	COMMENT
LOW⚡	internal/pipeline/fullrun.go	138	// Step 1: Research	COMMENT
LOW⚡	internal/pipeline/fullrun.go	146	// Step 2: Generate	COMMENT
LOW⚡	internal/pipeline/fullrun.go	192	// Step 3: Count commands and resources	COMMENT
LOW⚡	internal/pipeline/fullrun.go	197	// Step 4: API Coverage estimate	COMMENT
LOW⚡	internal/pipeline/fullrun.go	204	// Step 5: Dogfood	COMMENT
LOW⚡	internal/pipeline/fullrun.go	257	// Step 6: Scorecard	COMMENT
LOW⚡	internal/pipeline/fullrun.go	265	// Step 7: Fix Plans	COMMENT
LOW	internal/pipeline/contracts_test.go	669	labelBlock := substringBetween(t, issueTemplate, "## Step 1: Ensure labels exist", "## Step 2: Sort work units")	CODE
LOW	internal/pipeline/contracts_test.go	1169	step7 := strings.Index(skill, "## Step 7: Collision Detection & Resolution")	CODE
LOW⚡	internal/pipeline/contracts_test.go	1472	validateStart := strings.Index(skill, "## Step 4: Validate")	CODE
LOW⚡	internal/pipeline/contracts_test.go	1474	cloneStart := strings.Index(skill, "## Step 5: Managed Clone")	CODE
71 more matches not shown…

Modern AI Meta-Vocabulary71 hits · 212 pts

Severity	File	Line	Snippet	Context
MEDIUM	…learn-loop-api/learn-loop-example/internal/cli/root.go	80	// command replaces a TODO scaffold with the same name.	COMMENT
MEDIUM	…onids/fastapi-operationids-golden/internal/cli/root.go	87	// command replaces a TODO scaffold with the same name.	COMMENT
MEDIUM	…-scaffold/novel-feature-scaffold/internal/cli/audit.go	2	// Novel command scaffold. Implement the RunE body before shipping.	COMMENT
MEDIUM	…caffold/novel-feature-scaffold/internal/cli/inspect.go	2	// Novel command scaffold. Implement the RunE body before shipping.	COMMENT
MEDIUM	…sabled-api/learn-disabled-example/internal/cli/root.go	75	// command replaces a TODO scaffold with the same name.	COMMENT
MEDIUM	…-golden-api/printing-press-golden/internal/cli/root.go	86	// command replaces a TODO scaffold with the same name.	COMMENT
MEDIUM	…en/cases/generate-novel-feature-scaffold/artifacts.txt	1	# Locks the novel-feature command scaffold dry-run contract. Planned	COMMENT
MEDIUM	…lden/cases/generate-novel-feature-scaffold/command.txt	2	"$BINARY" generate --spec testdata/golden/fixtures/novel-feature-scaffold.yaml --research-dir testdata/golden/fixtures/n	CODE
MEDIUM⚡	testdata/golden/cases/generate-mcp-api/artifacts.txt	3	# (transport: [stdio, http], orchestration: code, endpoint_tools: hidden).	COMMENT
MEDIUM⚡	testdata/golden/cases/generate-mcp-api/artifacts.txt	13	# Code-orchestration mode: tools.go must call RegisterCodeOrchestrationTools	COMMENT
MEDIUM⚡	testdata/golden/cases/generate-mcp-api/artifacts.txt	18	# Code-orchestration tool bodies: tools.go calls RegisterCodeOrchestrationTools,	COMMENT
MEDIUM	internal/pipeline/dogfood_test.go	4194	// agentic review, not a hard gate.	COMMENT
MEDIUM	internal/pipeline/dogfood.go	119	// warning surfaced to Phase 4.85 (Wave B) for agentic review — trivial	COMMENT
MEDIUM	internal/pipeline/dogfood.go	3035	// surfaced to Wave B's Phase 4.85 agentic reviewer for deeper judgment.	COMMENT
MEDIUM	internal/pipeline/dogfood.go	3037	// tests; the agentic review is better at judging coverage quality.	COMMENT
MEDIUM	internal/pipeline/reimplementation_check.go	488	// scaffold's auto default remains beside one narrower declaration, the narrower	COMMENT
MEDIUM	internal/pipeline/novel_host_check.go	286	// root.go defines the scaffold marker constant and is not a novel command.	COMMENT
MEDIUM	internal/pipeline/polish_testrefs_test.go	17	// generator's own scaffold tests call, 25 times in one case — look unreferenced.	COMMENT
MEDIUM	internal/pipeline/polish_testrefs_test.go	24	// RootCmd is constructed by main and by every scaffold test.	COMMENT
MEDIUM	internal/pipeline/naming_rules.go	23	// schema-layer guardrails documented in their 2026-04-13 Wrangler CLI post:	COMMENT
MEDIUM	internal/pipeline/live_check.go	120	// downstream consumers (Phase 4.85's agentic output review in particular)	COMMENT
MEDIUM	internal/pipeline/live_check.go	153	// readable and agentic reviewers don't blow through their context window on	COMMENT
MEDIUM	internal/pipeline/live_check_test.go	1811	// Phase 4.85's agentic reviewer needs the captured stdout to judge	COMMENT
MEDIUM	internal/pipeline/live_check_test.go	1856	// scorecard JSON or overwhelm an agentic reviewer's context window.	COMMENT
MEDIUM	internal/pipeline/contracts_test.go	794	skillReview := substringBetween(t, skill, "## 14-agentic-skill-review (Phase 4.8: Agentic SKILL Review)", "## 15-readme	CODE
MEDIUM	internal/pipeline/contracts_test.go	795	docsReview := substringBetween(t, skill, "## 15-readme-skill-agents-correctness-audit (Phase 4.9: README/SKILL/AGENTS C	CODE
MEDIUM	internal/pipeline/regenmerge/merge_into_fresh_test.go	1197	// Novel command scaffold tests. Keep the wiring smoke test and add behavior cases as needed.	COMMENT
MEDIUM⚡	internal/pipeline/regenmerge/merge_into_fresh_test.go	1212	// cli-printing-press: novel-scaffold-test	COMMENT
MEDIUM⚡	internal/pipeline/regenmerge/merge_into_fresh_test.go	1213	// Novel command scaffold tests. Keep the wiring smoke test and add behavior cases as needed.	COMMENT
MEDIUM⚡	internal/pipeline/regenmerge/merge_into_fresh_test.go	1223	// scaffold with operator-authored tests, while the fresh file is the new	COMMENT
MEDIUM⚡	internal/pipeline/regenmerge/merge_into_fresh_test.go	1224	// marker-based editable scaffold. Once both sides are markerless novel files,	COMMENT
MEDIUM	internal/pipeline/regenmerge/merge_into_fresh_test.go	1245	// Novel command scaffold. Implement the RunE body; generate --force preserves this file.	COMMENT
MEDIUM	internal/pipeline/regenmerge/merge_into_fresh_test.go	1269	// Novel command scaffold. Implement the RunE body; generate --force preserves this file.	COMMENT
MEDIUM	internal/pipeline/regenmerge/merge_into_fresh_test.go	1315	// Novel command scaffold. Implement the RunE body; generate --force preserves this file.	COMMENT
MEDIUM	internal/pipeline/regenmerge/merge_into_fresh_test.go	1337	// Novel command scaffold. Implement the RunE body; generate --force preserves this file.	COMMENT
MEDIUM	internal/pipeline/regenmerge/hand_authored_drop_test.go	61	scaffold := []byte(`// Novel command scaffold. Implement the RunE body; generate --force preserves this file.	CODE
MEDIUM	internal/spec/spec.go	1814	// validateAuthCompanion enforces the small set of guardrails on the	COMMENT
MEDIUM	internal/spec/spec.go	343	Streaming StreamingConfig `yaml:"streaming,omitempty" json:"streaming"` // streaming-pri	CODE
MEDIUM	internal/cli/printing_press_skill_test.go	307	gateEnd := strings.Index(rest, "### Why agentic")	CODE
MEDIUM	internal/openapi/parser.go	1352	// authorization URL so the generator selects the service-account scaffold.	COMMENT
MEDIUM	internal/openapi/parser.go	8750	// isGoogleServiceAccountOAuth2 narrows the Google auth scaffold to OAuth2	COMMENT
MEDIUM	internal/generator/plan_generate.go	87	// will emit for user-declared plan commands after scaffold-owned names are	COMMENT
MEDIUM	internal/generator/plan_generate.go	99	// GenerateFromPlan creates a CLI scaffold from a parsed plan spec.	COMMENT
MEDIUM	internal/generator/plan_generate.go	108	// owner stays the slug for module path / Homebrew tap. The plan scaffold has	COMMENT
MEDIUM	internal/generator/plan_generate.go	666	// plan-scaffold func maps.	COMMENT
MEDIUM	internal/generator/novel_feature_stubs_test.go	522	// scaffold. The hand-authored hook must win without creating a shadowed	COMMENT
MEDIUM	internal/generator/learn_emission_test.go	74	// U9: internal/cli/playbooks/ ships the embed.FS scaffold for	COMMENT
MEDIUM	internal/generator/learn_emission_test.go	122	// U9: cli/playbooks/ embed.FS scaffold is gated off too.	COMMENT
MEDIUM	internal/generator/generator.go	3955	// internal/cli/playbooks/ ships the embed.FS scaffold for hand-	COMMENT
MEDIUM	internal/generator/generator.go	3957	// scaffold only — the auto-install path that walks this FS lives	COMMENT
MEDIUM	docs/PIPELINE.md	110	### 3. scaffold	COMMENT
MEDIUM	…ors/auth-none-dead-code-in-config-client-2026-05-08.md	26	# No-auth specs emitted dead token scaffolding in config.go and client.go	COMMENT
MEDIUM	…ors/auth-none-dead-code-in-config-client-2026-05-08.md	50	The predicate's doc comment names the central auth-emission gate. Before PR #704, `auth.go`, `root.go`, and `scoreAuth`	CODE
MEDIUM	…delity-flag-decl-regex-and-mark-required-2026-05-22.md	67	- Related to #1561 — same pattern of scorer substring greps drifting from the SKILL's sanctioned scaffolding (different	CODE
MEDIUM	docs/retros/2026-04-08-linear-retro.md	47	### 3. GraphQL sync command must be hand-written (Missing scaffolding)	COMMENT
MEDIUM	docs/retros/2026-04-11-movie-goat-retro.md	103	### F8. No multi-API enrichment scaffolding (missing scaffolding)	COMMENT
MEDIUM	docs/retros/2026-04-05-cal-com-retro.md	79	### 6. Verify Cannot Test Data-Layer-Dependent Commands (Missing scaffolding)	COMMENT
MEDIUM	docs/retros/2026-03-30-postman-explore-retro.md	66	### 5. Entity-Specific Store Methods Not Generated (missing scaffolding)	COMMENT
MEDIUM	docs/retros/2026-04-03-postman-explore-run2-retro.md	115	### 8. Store migration doesn't create entity-specific tables for sniffed specs (Missing scaffolding)	COMMENT
MEDIUM	docs/retros/2026-04-23-producthunt-retro.md	55	Root cause #3: Phase 4.8's agentic SKILL review has a prompt contract that covers **trigger phrases, novel-feature d	CODE
11 more matches not shown…

Decorative Section Separators44 hits · 153 pts

Severity	File	Line	Snippet	Context
MEDIUM⚡	internal/cli/verify_skill_bundled.py	2310	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	internal/cli/verify_skill_bundled.py	2312	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	internal/cli/verify_skill_bundled.py	132	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	internal/cli/verify_skill_bundled.py	134	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	internal/cli/verify_skill_bundled.py	2678	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	internal/cli/verify_skill_bundled.py	2680	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	internal/cli/verify_skill_bundled.py	3057	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	internal/cli/verify_skill_bundled.py	3059	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	scripts/verify-skill/verify_skill.py	2310	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	scripts/verify-skill/verify_skill.py	2312	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/verify-skill/verify_skill.py	132	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/verify-skill/verify_skill.py	134	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/verify-skill/verify_skill.py	2678	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/verify-skill/verify_skill.py	2680	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/verify-skill/verify_skill.py	3057	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	scripts/verify-skill/verify_skill.py	3059	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	.github/scripts/verify-supply-chain/signals.py	344	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	.github/scripts/verify-supply-chain/signals.py	346	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	.github/scripts/verify-supply-chain/signals.py	440	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	.github/scripts/verify-supply-chain/signals.py	442	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	.github/scripts/verify-supply-chain/signals.py	37	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	.github/scripts/verify-supply-chain/signals.py	39	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	.github/scripts/verify-supply-chain/signals.py	63	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	.github/scripts/verify-supply-chain/signals.py	65	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	.github/scripts/verify-supply-chain/signals.py	83	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	.github/scripts/verify-supply-chain/signals.py	85	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	.github/scripts/verify-supply-chain/signals.py	286	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	.github/scripts/verify-supply-chain/signals.py	288	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	.github/scripts/verify-supply-chain/signals.py	390	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	.github/scripts/verify-supply-chain/signals.py	392	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	.github/scripts/verify-supply-chain/signals.py	487	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	.github/scripts/verify-supply-chain/signals.py	489	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	.github/scripts/verify-supply-chain/scan.py	33	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	.github/scripts/verify-supply-chain/scan.py	35	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	.github/scripts/verify-supply-chain/scan.py	112	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	.github/scripts/verify-supply-chain/scan.py	114	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	.github/scripts/verify-supply-chain/scan.py	124	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	.github/scripts/verify-supply-chain/scan.py	126	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	.github/scripts/verify-supply-chain/scan.py	144	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	.github/scripts/verify-supply-chain/scan.py	146	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	.github/scripts/verify-supply-chain/scan_test.py	41	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	.github/scripts/verify-supply-chain/scan_test.py	43	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	.github/scripts/verify-supply-chain/scan_test.py	302	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	.github/scripts/verify-supply-chain/scan_test.py	304	# ---------------------------------------------------------------------------	COMMENT

Hyper-Verbose Identifiers157 hits · 126 pts

Severity	File	Line	Snippet	Context
LOW⚡	internal/cli/verify_skill_bundled.py	2315	def _cli_invocation_from_tokens(	CODE
LOW	internal/cli/verify_skill_bundled.py	362	def _returned_command_variable(body: str, local_commands: dict) -> str \| None:	CODE
LOW	internal/cli/verify_skill_bundled.py	634	def _first_param_if_cobra_command(params: str) -> str \| None:	CODE
LOW	internal/cli/verify_skill_bundled.py	1688	def _apply_scaffold_replacement(	CODE
LOW	internal/cli/verify_skill_bundled.py	1853	def collect_command_constructors(cli_dir: Path) -> dict[str, CommandConstructor]:	CODE
LOW	internal/cli/verify_skill_bundled.py	1953	def _legacy_find_command_source(cli_dir: Path, cmd_path: list[str]):	CODE
LOW	internal/cli/verify_skill_bundled.py	2078	def _command_boolean_flag_names(cli_dir: Path, cmd_path: tuple[str, ...]) -> frozenset[str]:	CODE
LOW	internal/cli/verify_skill_bundled.py	2214	def _helper_names_called_with_cmd(text: str, receivers: set[str] \| None = None) -> set[str]:	CODE
LOW	internal/cli/verify_skill_bundled.py	2410	def _split_before_shell_operator(line: str) -> str:	CODE
LOW	internal/cli/verify_skill_bundled.py	2458	def _strip_trailing_shell_comment(line: str) -> str:	CODE
LOW	internal/cli/verify_skill_bundled.py	2500	def _shell_operator_cut_index(line: str, operator_index: int) -> int:	CODE
LOW	internal/cli/verify_skill_bundled.py	2511	def _extract_prose_invocations(	CODE
LOW	internal/cli/verify_skill_bundled.py	2634	def _bash_blocks_with_line_numbers(text: str) -> Iterable[tuple[int, str]]:	CODE
LOW	internal/cli/verify_skill_bundled.py	2640	def _unquoted_shell_variables(line: str) -> list[str]:	CODE
LOW	internal/cli/verify_skill_bundled.py	2796	def _subcommand_fallback_files(cli_dir: Path, candidate: list[str]) -> list[Path]:	CODE
LOW	scripts/govulncheck_stdlib_test.py	99	def test_keeps_called_stdlib_and_drops_other_hits(self) -> None:	CODE
LOW	scripts/govulncheck_stdlib_test.py	117	def test_title_uses_the_highest_fixed_release_across_scans(self) -> None:	CODE
LOW	scripts/govulncheck_stdlib_test.py	135	def test_unfixed_called_stdlib_uses_unresolved_title(self) -> None:	CODE
LOW	scripts/govulncheck_stdlib_test.py	157	def test_invalid_json_is_an_error(self) -> None:	CODE
LOW	scripts/govulncheck_stdlib_test.py	162	def test_parses_pretty_printed_stream(self) -> None:	CODE
LOW	scripts/govulncheck_stdlib_test.py	179	def test_config_only_stream_is_not_actionable(self) -> None:	CODE
LOW⚡	scripts/generator_test_shards_test.py	42	def test_every_test_lands_in_exactly_one_bin(self) -> None:	CODE
LOW⚡	scripts/generator_test_shards_test.py	50	def test_bins_balance_within_largest_weight(self) -> None:	CODE
LOW⚡	scripts/generator_test_shards_test.py	56	def test_unknown_test_gets_median_weight(self) -> None:	CODE
LOW⚡	scripts/generator_test_shards_test.py	62	def test_parse_list_keeps_test_example_fuzz(self) -> None:	CODE
LOW⚡	scripts/generator_test_shards_test.py	66	def test_parse_list_rejects_duplicates_and_empty(self) -> None:	CODE
LOW⚡	scripts/generator_test_shards_test.py	72	def test_plan_rejects_bad_total(self) -> None:	CODE
LOW⚡	scripts/generator_test_shards_test.py	96	def test_shards_partition_the_list_across_processes(self) -> None:	CODE
LOW⚡	scripts/generator_test_shards_test.py	106	def test_plan_is_independent_of_hash_seed(self) -> None:	CODE
LOW⚡	scripts/generator_test_shards_test.py	112	def test_summary_reports_unknown_and_stale(self) -> None:	CODE
LOW⚡	scripts/generator_test_shards_test.py	119	def test_index_out_of_range_fails(self) -> None:	CODE
LOW	scripts/generator_test_shards_test.py	166	def test_missing_result_fails_and_names_test(self) -> None:	CODE
LOW	scripts/generator_test_shards_test.py	179	def test_parses_github_log_prefix_and_discounts_parallel_tests(self) -> None:	CODE
LOW	scripts/generator_test_shards_test.py	192	def test_median_across_inputs(self) -> None:	CODE
LOW	scripts/generator_test_shards_test.py	208	def test_main_ci_matrix_matches_shard_total(self) -> None:	CODE
LOW	scripts/generator_test_shards_test.py	211	def test_matrix_drift_is_detected(self) -> None:	CODE
LOW⚡	scripts/verify_go_floor_test.py	36	def test_real_directive_does_not_exceed_go_mod(self) -> None:	CODE
LOW⚡	scripts/verify_go_floor_test.py	43	def test_directive_above_go_mod_fails(self) -> None:	CODE
LOW⚡	scripts/verify_go_floor_test.py	52	def test_older_library_warns_unless_enforced(self) -> None:	CODE
LOW	scripts/verify_go_floor_test.py	63	def test_matching_library_is_a_note(self) -> None:	CODE
LOW	scripts/verify_go_floor_test.py	72	def test_network_and_parse_errors_warn_unless_enforced(self) -> None:	CODE
LOW⚡	scripts/verify_go_floor_test.py	106	def test_main_passes_when_library_matches_directive(self) -> None:	CODE
LOW⚡	scripts/verify_go_floor_test.py	112	def test_main_warns_when_library_is_older(self) -> None:	CODE
LOW⚡	scripts/verify_go_floor_test.py	117	def test_main_fails_when_enforced_and_library_is_older(self) -> None:	CODE
LOW⚡	scripts/verify_go_floor_test.py	122	def test_main_fails_when_enforced_and_fetch_fails(self) -> None:	CODE
LOW⚡	scripts/verify-skill/test_resolve_command_path.py	61	def test_braces_inside_string(self):	CODE
LOW⚡	scripts/verify-skill/test_resolve_command_path.py	66	def test_braces_inside_raw_string(self):	CODE
LOW⚡	scripts/verify-skill/test_resolve_command_path.py	71	def test_braces_inside_line_comment(self):	CODE
LOW⚡	scripts/verify-skill/test_resolve_command_path.py	76	def test_braces_inside_block_comment(self):	CODE
LOW⚡	scripts/verify-skill/test_resolve_command_path.py	81	def test_unclosed_returns_none(self):	CODE
LOW⚡	scripts/verify-skill/test_resolve_command_path.py	88	def test_resolves_top_level_when_leaf_collides_with_subcommand(self):	CODE
LOW⚡	scripts/verify-skill/test_resolve_command_path.py	2107	def test_unquoted_shell_variables_handles_bare_and_braced_forms(self):	STRING
LOW⚡	scripts/verify-skill/test_resolve_command_path.py	2112	def test_unquoted_shell_variables_tracks_quote_state_and_escapes(self):	STRING
LOW⚡	scripts/verify-skill/test_resolve_command_path.py	2117	def test_check_shell_var_quotes_reports_skill_and_readme_evidence(self):	STRING
LOW	scripts/verify-skill/test_resolve_command_path.py	131	def test_constructor_collection(self):	STRING
LOW	scripts/verify-skill/test_resolve_command_path.py	156	def test_root_children_discovery(self):	STRING
LOW	scripts/verify-skill/test_resolve_command_path.py	179	def test_unresolvable_path_returns_none(self):	STRING
LOW	scripts/verify-skill/test_resolve_command_path.py	199	def test_constructor_with_func_typed_param(self):	STRING
LOW	scripts/verify-skill/test_resolve_command_path.py	221	def test_collect_command_constructors_is_cached(self):	STRING
LOW	scripts/verify-skill/test_resolve_command_path.py	239	def test_legacy_fallback_when_no_root_addcommand(self):	STRING
97 more matches not shown…

Verbosity Indicators64 hits · 118 pts

Severity	File	Line	Snippet	Context
LOW	…h-doctor/additional-auth-doctor/internal/cli/doctor.go	382	// Step 1: Basic reachability via the configured transport.	COMMENT
LOW	…h-doctor/additional-auth-doctor/internal/cli/doctor.go	426	// Step 2: Validate credentials with an authenticated probe.	COMMENT
LOW	…lit-token-auth/split-token-auth/internal/cli/doctor.go	383	// Step 1: Basic reachability via the configured transport.	COMMENT
LOW	…lit-token-auth/split-token-auth/internal/cli/doctor.go	427	// Step 2: Validate credentials with an authenticated probe.	COMMENT
LOW	…ookie-auth/golden-api-cookie-auth/internal/cli/auth.go	141	// Step 0: Try press-auth, the dedicated cookie capture companion.	COMMENT
LOW	…ookie-auth/golden-api-cookie-auth/internal/cli/auth.go	180	// Step 1: Detect cookie extraction tool	COMMENT
LOW	…ookie-auth/golden-api-cookie-auth/internal/cli/auth.go	203	// Step 2: Resolve which Chrome profile to use when the backend can honor it	COMMENT
LOW	…ookie-auth/golden-api-cookie-auth/internal/cli/auth.go	226	// Step 3: Extract cookies from the resolved profile	COMMENT
LOW	…ookie-auth/golden-api-cookie-auth/internal/cli/auth.go	268	// Step 5: Save to config	COMMENT
LOW	…ss-openapi/keyless-leftover-env/internal/cli/doctor.go	295	// Step 1: Basic reachability via the configured transport.	COMMENT
LOW	…ss-openapi/keyless-leftover-env/internal/cli/doctor.go	339	// Step 2: Validate credentials with an authenticated probe.	COMMENT
LOW	…keyless-openapi/keyless-openapi/internal/cli/doctor.go	295	// Step 1: Basic reachability via the configured transport.	COMMENT
LOW	…keyless-openapi/keyless-openapi/internal/cli/doctor.go	339	// Step 2: Validate credentials with an authenticated probe.	COMMENT
LOW	…routing-api/tier-routing-golden/internal/cli/doctor.go	379	// Step 1: Basic reachability via the configured transport.	COMMENT
LOW	…routing-api/tier-routing-golden/internal/cli/doctor.go	423	// Step 2: Validate credentials with an authenticated probe.	COMMENT
LOW	…olden-api/printing-press-golden/internal/cli/doctor.go	357	// Step 1: Basic reachability via the configured transport.	COMMENT
LOW	…olden-api/printing-press-golden/internal/cli/doctor.go	401	// Step 2: Validate credentials with an authenticated probe.	COMMENT
LOW	…h-auth/printing-press-rich-auth/internal/cli/doctor.go	409	// Step 1: Basic reachability via the configured transport.	COMMENT
LOW	…h-auth/printing-press-rich-auth/internal/cli/doctor.go	453	// Step 2: Validate credentials with an authenticated probe.	COMMENT
LOW⚡	internal/pipeline/research.go	267	// Step 3: Deduplicate by URL	COMMENT
LOW⚡	internal/pipeline/research.go	270	// Step 4: Score novelty and produce recommendation	COMMENT
LOW⚡	internal/pipeline/research.go	274	// Step 5: Analyze gaps and patterns	COMMENT
LOW	internal/pipeline/research.go	325	// Step 6: Write research.json	COMMENT
LOW⚡	internal/pipeline/workflow_manifest_test.go	60	// Step 0: stores find_stores	COMMENT
LOW⚡	internal/pipeline/workflow_manifest_test.go	69	// Step 1: menu get_menu	COMMENT
LOW⚡	internal/pipeline/workflow_manifest_test.go	76	// Step 2: cart new	COMMENT
LOW⚡	internal/pipeline/workflow_manifest_test.go	83	// Step 3: cart add ${item_code}	COMMENT
LOW⚡	internal/pipeline/workflow_manifest_test.go	88	// Step 4: orders price_order	COMMENT
LOW⚡	internal/pipeline/fullrun.go	26	// Step 1: Research	COMMENT
LOW⚡	internal/pipeline/fullrun.go	30	// Step 2: Generate	COMMENT
LOW⚡	internal/pipeline/fullrun.go	38	// Step 3: Coverage	COMMENT
LOW⚡	internal/pipeline/fullrun.go	45	// Step 4: Dogfood	COMMENT
LOW⚡	internal/pipeline/fullrun.go	58	// Step 5: Scorecard	COMMENT
LOW⚡	internal/pipeline/fullrun.go	62	// Step 6: Learnings	COMMENT
LOW⚡	internal/pipeline/fullrun.go	138	// Step 1: Research	COMMENT
LOW⚡	internal/pipeline/fullrun.go	146	// Step 2: Generate	COMMENT
LOW⚡	internal/pipeline/fullrun.go	192	// Step 3: Count commands and resources	COMMENT
LOW⚡	internal/pipeline/fullrun.go	197	// Step 4: API Coverage estimate	COMMENT
LOW⚡	internal/pipeline/fullrun.go	204	// Step 5: Dogfood	COMMENT
LOW⚡	internal/pipeline/fullrun.go	257	// Step 6: Scorecard	COMMENT
LOW⚡	internal/pipeline/fullrun.go	265	// Step 7: Fix Plans	COMMENT
LOW	internal/pipeline/contracts_test.go	669	labelBlock := substringBetween(t, issueTemplate, "## Step 1: Ensure labels exist", "## Step 2: Sort work units")	CODE
LOW	internal/pipeline/contracts_test.go	1169	step7 := strings.Index(skill, "## Step 7: Collision Detection & Resolution")	CODE
LOW⚡	internal/pipeline/contracts_test.go	1472	validateStart := strings.Index(skill, "## Step 4: Validate")	CODE
LOW⚡	internal/pipeline/contracts_test.go	1474	cloneStart := strings.Index(skill, "## Step 5: Managed Clone")	CODE
LOW	internal/pipeline/mcpsync/sync_test.go	543	// Step 1: generate the CLI with an initial spec (no key_url, not optional).	COMMENT
LOW⚡	internal/pipeline/mcpsync/sync_test.go	571	// Step 2: simulate a generate-time provenance write. WriteManifestForGenerate	COMMENT
LOW⚡	internal/pipeline/mcpsync/sync_test.go	579	// Step 3: edit spec.yaml with the new auth.key_url + auth.optional that	COMMENT
LOW⚡	internal/pipeline/mcpsync/sync_test.go	588	// Step 4: run mcp-sync. It should pick up the new spec values and	COMMENT
LOW⚡	internal/pipeline/mcpsync/sync_test.go	594	// Step 5: verify .printing-press.json now reflects the new spec.	COMMENT
LOW⚡	internal/pipeline/mcpsync/sync_test.go	602	// Step 6: verify the MCPB manifest names the credential the binary	COMMENT
LOW⚡	internal/crowdsniff/aggregate.go	183	// Step 1: Convert :id, {user_id}, <id>, $id → {id}	COMMENT
LOW⚡	internal/crowdsniff/aggregate.go	184	// Step 2: Replace UUIDs, numeric IDs, long hashes → {id}/{uuid}/{hash}	COMMENT
LOW⚡	internal/crowdsniff/aggregate.go	198	// Step 1: Unify parameter syntax → {id}	COMMENT
LOW⚡	internal/crowdsniff/aggregate.go	208	// Step 2: Replace concrete values	COMMENT
LOW⚡	internal/crowdsniff/npm.go	155	// Step 1: Search the registry.	COMMENT
LOW⚡	internal/crowdsniff/npm.go	165	// Step 2: Filter by recency.	COMMENT
LOW⚡	internal/crowdsniff/npm.go	177	// Step 3: Take top N packages.	COMMENT
LOW⚡	internal/crowdsniff/npm.go	182	// Step 4: Fetch download counts (non-fatal).	COMMENT
LOW⚡	internal/crowdsniff/npm.go	185	// Step 5: Process each package.	COMMENT
4 more matches not shown…

Fake / Example Data90 hits · 102 pts

Severity	File	Line	Snippet	Context
LOW	internal/pipeline/live_dogfood_test.go	1803	require.NotContains(t, result.OutputSample, "Jane Doe")	CODE
LOW	internal/pipeline/live_dogfood_test.go	1829	stdout: `{"name":"Jane Doe","auth":"` + authSecret[:len(authSecret)/2],	CODE
LOW	internal/pipeline/live_dogfood_test.go	1836	require.NotContains(t, result.OutputSample, "Jane Doe")	CODE
LOW	internal/pipeline/live_dogfood_test.go	4784	printf '{"id":"first","name":"Jane Doe"}\n'	CODE
LOW	internal/pipeline/docsync_test.go	281	"placeholder",	CODE
LOW	internal/pipeline/docsync_test.go	291	"placeholder",	CODE
LOW	internal/pipeline/publish_test.go	1325	Creator: &spec.Person{Handle: "jane-doe", Name: "Jane Doe"},	CODE
LOW	internal/pipeline/publish_test.go	1327	PrinterName: "Jane Doe",	CODE
LOW	internal/pipeline/manifest_attribution_write_test.go	33	Contributors: []spec.Person{{Handle: "jane-doe", Name: "Jane Doe"}},	CODE
LOW	internal/pipeline/manifest_attribution_write_test.go	63	first.Contributors = []spec.Person{{Handle: "jane-doe", Name: "Jane Doe"}}	CODE
LOW	internal/pipeline/manifest_attribution_write_test.go	171	first.Contributors = []spec.Person{{Handle: "jane-doe", Name: "Jane Doe"}}	CODE
LOW	internal/pipeline/lock_test.go	945	Contributors: []spec.Person{{Handle: "jane-doe", Name: "Jane Doe"}},	CODE
LOW	internal/pipeline/append_contributor_test.go	25	added, err := AppendContributor(dir, spec.Person{Handle: "jane-doe", Name: "Jane Doe"}, false)	CODE
LOW⚡	internal/pipeline/append_contributor_test.go	60	writeManifestJSON(t, dir, `{"cli_name":"acme-pp-cli","creator":{"handle":"trevin-chow","name":"Trevin Chow"},"contribu	CODE
LOW⚡	internal/pipeline/append_contributor_test.go	62	added, err := AppendContributor(dir, spec.Person{Handle: "JANE-DOE", Name: "Jane Doe"}, false)	CODE
LOW⚡	internal/pipeline/append_contributor_test.go	70	writeManifestJSON(t, dir, `{"cli_name":"acme-pp-cli","creator":{"handle":"trevin-chow","name":"Trevin Chow"},"contribu	CODE
LOW	internal/pipeline/append_contributor_test.go	86	_, err := AppendContributor(dir, spec.Person{Handle: "jane-doe", Name: "Jane Doe"}, false)	CODE
LOW	internal/pipeline/append_contributor_test.go	107	added, synced, err := RecordContributor(dir, spec.Person{Handle: "jane-doe", Name: "Jane Doe"}, false)	CODE
LOW	internal/pipeline/append_contributor_test.go	333	added, err := AppendContributor(dir, spec.Person{Name: "Jane Doe"}, false)	CODE
LOW⚡	internal/pipeline/promote_attribution_test.go	32	Creator: &spec.Person{Handle: "jane-doe", Name: "Jane Doe"},	CODE
LOW⚡	internal/pipeline/promote_attribution_test.go	34	PrinterName: "Jane Doe",	CODE
LOW⚡	internal/pipeline/promote_attribution_test.go	39	assert.Equal(t, "Jane Doe", m.Creator.Name)	CODE
LOW	internal/pipeline/attribution_model_test.go	20	{Handle: "jane-doe", Name: "Jane Doe"},	CODE
LOW	internal/pipeline/attribution_model_test.go	60	"contributors": [{"handle": "jane-doe", "name": "Jane Doe"}],	CODE
LOW⚡	internal/pipeline/live_check_test.go	862	got := sampleOutput(`{"name":"Jane Doe","email":"jane@gmail.com","address":"123 Main Street","id":42,"status":"active"}	CODE
LOW⚡	internal/pipeline/live_check_test.go	862	got := sampleOutput(`{"name":"Jane Doe","email":"jane@gmail.com","address":"123 Main Street","id":42,"status":"active"}	CODE
LOW⚡	internal/pipeline/live_check_test.go	864	require.NotContains(t, got, "Jane Doe")	CODE
LOW⚡	internal/pipeline/live_check_test.go	866	require.NotContains(t, got, "123 Main Street")	CODE
LOW⚡	internal/pipeline/live_check_test.go	882	got := sampleOutput(fmt.Sprintf(`{"name":"Jane Doe","email":"jane@gmail.com","note":%q}`, longNote))	CODE
LOW⚡	internal/pipeline/live_check_test.go	885	require.NotContains(t, got, "Jane Doe")	CODE
LOW⚡	internal/pipeline/live_check_test.go	894	require.NotContains(t, got, "Jane Doe")	CODE
LOW	internal/pipeline/live_check_test.go	1829	printf '{"name":"Jane Doe","email":"jane@gmail.com"}' >&2	CODE
LOW	internal/pipeline/live_check_test.go	1840	require.NotContains(t, result.Reason, "Jane Doe")	CODE
LOW⚡	internal/artifacts/pii_test.go	20	got := RedactPIIText(`{"name":"Jane Doe","email":"jane@example.com","address":"123 Main Street","id":42,"status":"activ	CODE
LOW⚡	internal/artifacts/pii_test.go	20	got := RedactPIIText(`{"name":"Jane Doe","email":"jane@example.com","address":"123 Main Street","id":42,"status":"activ	CODE
LOW⚡	internal/artifacts/pii_test.go	22	require.NotContains(t, got, "Jane Doe")	CODE
LOW⚡	internal/artifacts/pii_test.go	24	require.NotContains(t, got, "123 Main Street")	CODE
LOW	internal/artifacts/pii_test.go	69	got, changed := RedactPIIJSONKeys(`{"name":"Jane Doe","note":"contact jane@example.com","id":42}`)	CODE
LOW	internal/artifacts/pii_test.go	72	require.NotContains(t, got, "Jane Doe")	CODE
LOW	internal/artifacts/pii_test.go	131	require.NotContains(t, got, "Jane Doe")	CODE
LOW	internal/artifacts/pii_test.go	150	require.NotContains(t, got, "123 Main Street")	CODE
LOW	internal/artifacts/pii_test.go	157	require.Contains(t, got, "user@example.com", "reserved example.com email must not be redacted")	CODE
LOW	internal/artifacts/pii_test.go	282	{name: "reserved-example-org", line: `"email": "anything@example.org"`, expectKinds: nil},	CODE
LOW	internal/artifacts/pii_account.go	289	case "example", "placeholder", "sample", "dummy", "fake", "test",	CODE
LOW	internal/artifacts/pii_account.go	305	for _, needle := range []string{"example", "placeholder", "redacted", "changeme", "dummy"} {	CODE
LOW	internal/artifacts/secrets.go	445	for _, token := range []string{"<redacted", "redacted", "example", "placeholder", "your-", "your_", "insert-", "changem	CODE
LOW⚡	internal/spec/person_test.go	39	contributors := []Person{{Handle: "jane-doe", Name: "Jane Doe"}}	CODE
LOW⚡	internal/spec/person_test.go	44	{Handle: "jane-doe", Name: "Jane Doe"},	CODE
LOW⚡	internal/spec/person_test.go	46	assert.Equal(t, []Person{{Handle: "jane-doe", Name: "Jane Doe"}}, contributors, "input slice is copied")	CODE
LOW⚡	internal/spec/person_test.go	51	{Handle: "jane-doe", Name: "Jane Doe"},	CODE
LOW	internal/spec/person_test.go	81	{Handle: "jane-doe", Name: "Jane Doe"},	CODE
LOW	internal/spec/spec_test.go	7020	wantErr: "placeholder",	CODE
LOW	internal/cli/publish_attribution_test.go	44	Creator: &spec.Person{Handle: "jane-doe", Name: "Jane Doe"},	CODE
LOW	internal/cli/publish_test.go	433	"printer_name": "Jane Doe",	CODE
LOW	internal/cli/publish_test.go	434	"creator": {"handle":"jane-doe","name":"Jane Doe"}	CODE
LOW	internal/cli/publish_test.go	445	assert.Equal(t, "Jane Doe", got.Creator.Name)	CODE
LOW	internal/cli/generate_test.go	440	Contributors: []spec.Person{{Handle: "jane-doe", Name: "Jane Doe"}},	CODE
LOW	internal/cli/contributors.go	41	cli-printing-press contributors add --handle jane-doe --name "Jane Doe" --dir .`,	CODE
LOW⚡	internal/openapi/parser_test.go	9580	require.Equal(t, map[string]any{"holder": "Acme Ltd", "currency": "GBP"}, open.RequestBodyExample)	CODE
LOW⚡	internal/openapi/parser_test.go	9583	assert.Equal(t, "Acme Ltd", holder.Example)	CODE
30 more matches not shown…

Magic Placeholder Names19 hits · 95 pts

Severity	File	Line	Snippet	Context
HIGH	…-token-auth/split-token-auth/internal/client/client.go	2794	if !strings.Contains(header, "<") && !strings.Contains(header, "YOUR_TOKEN_HERE") && !strings.Contains(header, "your-to	CODE
HIGH	…-token-auth/split-token-auth/internal/client/client.go	2817	case "<your-token>", "<your-key>", "<paste-your-key>", "YOUR_TOKEN_HERE", "your-token-here":	CODE
HIGH	…-cc/printing-press-oauth2-cc/internal/client/client.go	2611	if !strings.Contains(header, "<") && !strings.Contains(header, "YOUR_TOKEN_HERE") && !strings.Contains(header, "your-to	CODE
HIGH	…-cc/printing-press-oauth2-cc/internal/client/client.go	2634	case "<your-token>", "<your-key>", "<paste-your-key>", "YOUR_TOKEN_HERE", "your-token-here":	CODE
HIGH	…inting-press-oauth2-authcode/internal/client/client.go	2582	if !strings.Contains(header, "<") && !strings.Contains(header, "YOUR_TOKEN_HERE") && !strings.Contains(header, "your-to	CODE
HIGH	…inting-press-oauth2-authcode/internal/client/client.go	2605	case "<your-token>", "<your-key>", "<paste-your-key>", "YOUR_TOKEN_HERE", "your-token-here":	CODE
HIGH	…-auth/golden-api-cookie-auth/internal/client/client.go	2571	if !strings.Contains(header, "<") && !strings.Contains(header, "YOUR_TOKEN_HERE") && !strings.Contains(header, "your-to	CODE
HIGH	…-auth/golden-api-cookie-auth/internal/client/client.go	2594	case "<your-token>", "<your-key>", "<paste-your-key>", "YOUR_TOKEN_HERE", "your-token-here":	CODE
HIGH	…ting-api/tier-routing-golden/internal/client/client.go	2663	if !strings.Contains(header, "<") && !strings.Contains(header, "YOUR_TOKEN_HERE") && !strings.Contains(header, "your-to	CODE
HIGH	…ting-api/tier-routing-golden/internal/client/client.go	2686	case "<your-token>", "<your-key>", "<paste-your-key>", "YOUR_TOKEN_HERE", "your-token-here":	CODE
HIGH	…en-api/printing-press-golden/internal/client/client.go	2715	if !strings.Contains(header, "<") && !strings.Contains(header, "YOUR_TOKEN_HERE") && !strings.Contains(header, "your-to	CODE
HIGH	…en-api/printing-press-golden/internal/client/client.go	2738	case "<your-token>", "<your-key>", "<paste-your-key>", "YOUR_TOKEN_HERE", "your-token-here":	CODE
HIGH	…ing-press-oauth2-device-code/internal/client/client.go	2582	if !strings.Contains(header, "<") && !strings.Contains(header, "YOUR_TOKEN_HERE") && !strings.Contains(header, "your-to	CODE
HIGH	…ing-press-oauth2-device-code/internal/client/client.go	2605	case "<your-token>", "<your-key>", "<paste-your-key>", "YOUR_TOKEN_HERE", "your-token-here":	CODE
HIGH	internal/narrativecheck/narrativecheck_test.go	559	"stub auth set-token YOUR_TOKEN_HERE",	CODE
HIGH	internal/narrativecheck/narrativecheck_test.go	561	Result{Section: SectionQuickstart, Command: "stub auth set-token YOUR_TOKEN_HERE", Words: "auth set-token YOUR_TOKEN_H	CODE
HIGH	internal/generator/split_token_auth_test.go	258	` + serverField + `: "YOUR_TOKEN_HERE",	CODE
HIGH	internal/generator/placeholder_auth_test.go	44	for _, token := range []string{"<PAT>", "<your-token>", "YOUR_TOKEN_HERE"} {	CODE
HIGH	internal/generator/set_token_stdin_test.go	93	require.NotContains(t, got, "YOUR_TOKEN_HERE")	CODE

Deep Nesting43 hits · 22 pts

Severity	File	Line	Context
LOW	internal/cli/verify_skill_bundled.py	137	CODE
LOW	internal/cli/verify_skill_bundled.py	218	CODE
LOW	internal/cli/verify_skill_bundled.py	483	CODE
LOW	internal/cli/verify_skill_bundled.py	543	CODE
LOW	internal/cli/verify_skill_bundled.py	602	CODE
LOW	internal/cli/verify_skill_bundled.py	634	CODE
LOW	internal/cli/verify_skill_bundled.py	875	CODE
LOW	internal/cli/verify_skill_bundled.py	896	CODE
LOW	internal/cli/verify_skill_bundled.py	917	CODE
LOW	internal/cli/verify_skill_bundled.py	1194	CODE
LOW	internal/cli/verify_skill_bundled.py	1666	CODE
LOW	internal/cli/verify_skill_bundled.py	1708	CODE
LOW	internal/cli/verify_skill_bundled.py	1747	CODE
LOW	internal/cli/verify_skill_bundled.py	2125	CODE
LOW	internal/cli/verify_skill_bundled.py	2242	CODE
LOW	internal/cli/verify_skill_bundled.py	2315	CODE
LOW	internal/cli/verify_skill_bundled.py	2683	CODE
LOW	internal/cli/verify_skill_bundled.py	2706	CODE
LOW	internal/cli/verify_skill_bundled.py	2812	CODE
LOW	internal/cli/verify_skill_bundled.py	2886	CODE
LOW	scripts/verify-go-floor.py	181	CODE
LOW	scripts/generator_test_shards.py	88	CODE
LOW	scripts/verify-skill/verify_skill.py	137	CODE
LOW	scripts/verify-skill/verify_skill.py	218	CODE
LOW	scripts/verify-skill/verify_skill.py	483	CODE
LOW	scripts/verify-skill/verify_skill.py	543	CODE
LOW	scripts/verify-skill/verify_skill.py	602	CODE
LOW	scripts/verify-skill/verify_skill.py	634	CODE
LOW	scripts/verify-skill/verify_skill.py	875	CODE
LOW	scripts/verify-skill/verify_skill.py	896	CODE
LOW	scripts/verify-skill/verify_skill.py	917	CODE
LOW	scripts/verify-skill/verify_skill.py	1194	CODE
LOW	scripts/verify-skill/verify_skill.py	1666	CODE
LOW	scripts/verify-skill/verify_skill.py	1708	CODE
LOW	scripts/verify-skill/verify_skill.py	1747	CODE
LOW	scripts/verify-skill/verify_skill.py	2125	CODE
LOW	scripts/verify-skill/verify_skill.py	2242	CODE
LOW	scripts/verify-skill/verify_skill.py	2315	CODE
LOW	scripts/verify-skill/verify_skill.py	2683	CODE
LOW	scripts/verify-skill/verify_skill.py	2706	CODE
LOW	scripts/verify-skill/verify_skill.py	2812	CODE
LOW	scripts/verify-skill/verify_skill.py	2886	CODE
LOW	.github/scripts/verify-supply-chain/signals.py	216	CODE

Empty Error Handlers4 hits · 20 pts

Severity	File	Line	Snippet	Context
HIGH	internal/cli/verify_skill_bundled.py	3070	except Exception:	CODE
HIGH	internal/cli/verify_skill_bundled.py	3172	except (AttributeError, OSError):	CODE
HIGH	scripts/verify-skill/verify_skill.py	3070	except Exception:	CODE
HIGH	scripts/verify-skill/verify_skill.py	3172	except (AttributeError, OSError):	CODE

Excessive Try-Catch Wrapping19 hits · 16 pts

Severity	File	Line	Snippet	Context
LOW⚡	internal/cli/verify_skill_bundled.py	2302	except Exception:	CODE
LOW	internal/cli/verify_skill_bundled.py	1741	except Exception:	CODE
LOW	internal/cli/verify_skill_bundled.py	1970	except Exception:	CODE
LOW	internal/cli/verify_skill_bundled.py	2071	except Exception:	CODE
LOW	internal/cli/verify_skill_bundled.py	2106	except Exception:	CODE
LOW	internal/cli/verify_skill_bundled.py	2237	except Exception:	CODE
LOW	internal/cli/verify_skill_bundled.py	2270	except Exception:	CODE
LOW	internal/cli/verify_skill_bundled.py	3070	except Exception:	CODE
LOW⚡	scripts/verify-skill/verify_skill.py	2302	except Exception:	CODE
LOW	scripts/verify-skill/verify_skill.py	1741	except Exception:	CODE
LOW	scripts/verify-skill/verify_skill.py	1970	except Exception:	CODE
LOW	scripts/verify-skill/verify_skill.py	2071	except Exception:	CODE
LOW	scripts/verify-skill/verify_skill.py	2106	except Exception:	CODE
LOW	scripts/verify-skill/verify_skill.py	2237	except Exception:	CODE
LOW	scripts/verify-skill/verify_skill.py	2270	except Exception:	CODE
LOW	scripts/verify-skill/verify_skill.py	3070	except Exception:	CODE
LOW	.github/workflows/main-ci.yml	279	except Exception:	CODE
LOW	.github/workflows/lint.yml	201	except Exception:	CODE
LOW	.github/workflows/lint.yml	334	except Exception:	CODE

AI Slop Vocabulary5 hits · 15 pts

Severity	File	Line	Snippet	Context
MEDIUM	internal/pipeline/dogfood.go	2612	// line. Matching the open-brace through the literal "}" keeps the check robust	COMMENT
MEDIUM	internal/cli/browser_sniff_test.go	487	// Normalize to make the NotContains assertion robust across cobra versions.	COMMENT
MEDIUM	internal/cli/verify_skill_sync_test.go	112	// This is more robust than relying on PWD or runtime.Caller alone, because	COMMENT
MEDIUM	internal/generator/generator_test.go	17668	// We assert a robust shape: no occurrence of "ticker" inside the fallback	COMMENT
MEDIUM	scripts/golden.sh	66	# one (the standalone `generate` path the golden harness exercises).	COMMENT

Unused Imports15 hits · 13 pts

Severity	File	Line	Context
LOW	internal/cli/verify_skill_bundled.py	51	CODE
LOW	scripts/govulncheck_stdlib_test.py	4	CODE
LOW	scripts/generator_test_shards_test.py	4	CODE
LOW	scripts/govulncheck_stdlib.py	9	CODE
LOW	scripts/verify-go-floor.py	10	CODE
LOW	scripts/verify_go_floor_test.py	4	CODE
LOW	scripts/generator_test_shards.py	12	CODE
LOW	scripts/go_release.py	3	CODE
LOW	scripts/golden_normalize_windows.py	32	CODE
LOW	scripts/verify-skill/test_resolve_command_path.py	9	CODE
LOW	scripts/verify-skill/verify_skill.py	51	CODE
LOW	.github/scripts/verify-supply-chain/signals.py	27	CODE
LOW	.github/scripts/verify-supply-chain/scan.py	20	CODE
LOW	.github/scripts/verify-supply-chain/scan_test.py	13	CODE
LOW	.github/scripts/pr-review-state/greptile_feedback.py	8	CODE

Cross-Language Confusion2 hits · 10 pts

Severity	File	Line	Snippet	Context
HIGH	scripts/verify-skill/test_resolve_command_path.py	1899	}; []struct{ X int }{{X: 1}}[0].X == 1 && (struct{ Y int }{Y: 1}).Y == 1 && func() bool { return true }() {	CODE
HIGH	…ipts/verify-skill/test_scoped_flags_and_attachments.py	82	if bm, _, err := rootCmd.Find([]string{"users", "bookmarks"}); err == nil && bm.Name() == "bookmarks" {	CODE

Synthetic Comment Markers1 hit · 8 pts

Severity	File	Line	Snippet	Context
HIGH	internal/generator/textfilter.go	17	// aiSlopPatterns are regex patterns that detect common AI-generated text patterns.	COMMENT

Example Usage Blocks5 hits · 8 pts

Severity	File	Line	Snippet	Context
LOW	skills/printing-press-import/references/import-fetch.sh	5	# Usage:	COMMENT
LOW	skills/printing-press-import/references/import-place.sh	16	# Usage:	COMMENT
LOW	…ills/printing-press-import/references/import-backup.sh	5	# Usage:	COMMENT
LOW	…lls/printing-press-import/references/import-rewrite.sh	20	# Usage:	COMMENT
LOW	skills/printing-press/references/fetch-docs.sh	4	# Usage:	COMMENT

Redundant / Tautological Comments1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	internal/llm/llm_test.go	42	path=${prompt#Read the file at }	CODE

mvanhorn/cli-printing-press

Open-Source Code Quality, Security and Technical Debt Review