Fast, small, and fully autonomous AI personal assistant infrastructure, any OS, any platform — deploy anywhere, swap anything 🦀
This report presents the forensic synthetic code analysis of zeroclaw-labs/zeroclaw, a Rust project with 32,667 GitHub stars. SynthScan v2.0 examined 931,347 lines of code across 1727 source files, recording 3187 pattern matches distributed across 17 syntactic categories. The overall adjusted score of 7.6 places this repository in the Low AI signal band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 3187 distinct pattern matches across 17 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | install.sh | 4 | # ── ZeroClaw installer ─────────────────────────────────────────── | COMMENT |
| MEDIUM | install.sh | 11 | # ── Output helpers (terminal-aware) ────────────────────────────── | COMMENT |
| MEDIUM | install.sh | 38 | # ── Parse Cargo.toml (source of truth) ──────────────────────────── | COMMENT |
| MEDIUM | install.sh | 92 | # ── App registry ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | install.sh | 131 | # ── Feature validation ──────────────────────────────────────────── | COMMENT |
| MEDIUM | install.sh | 159 | # ── List features ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | install.sh | 196 | # ── Version comparison ──────────────────────────────────────────── | COMMENT |
| MEDIUM | install.sh | 215 | # ── Detect user's shell ────────────────────────────────────────── | COMMENT |
| MEDIUM | install.sh | 236 | # ── Platform / target triple detection ─────────────────────────── | COMMENT |
| MEDIUM | install.sh | 280 | # ── Pre-built binary install ────────────────────────────────────── | COMMENT |
| MEDIUM | install.sh | 385 | # ── Usage ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | install.sh | 437 | # ── Uninstall ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | install.sh | 509 | # ── Quickstart-needed status check ─────────────────────────────── | COMMENT |
| MEDIUM | install.sh | 527 | # ── Interactive feature picker ─────────────────────────────────── | COMMENT |
| MEDIUM | install.sh | 681 | # ── Web dashboard build for source installs ────────────────────── | COMMENT |
| MEDIUM | install.sh | 724 | # ── Low-memory build heuristic ──────────────────────────────────── | COMMENT |
| MEDIUM | install.sh | 750 | # ── Parse arguments ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | install.sh | 845 | # ── Derive paths from prefix ───────────────────────────────────── | COMMENT |
| MEDIUM | install.sh | 856 | # ── List features (can run without cloning if in repo) ──────────── | COMMENT |
| MEDIUM | install.sh | 869 | # ── Decide: pre-built or source ─────────────────────────────────── | COMMENT |
| MEDIUM | install.sh | 929 | # ── Locate source ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | install.sh | 960 | # ── Parse Cargo.toml ────────────────────────────────────────────── | COMMENT |
| MEDIUM | install.sh | 966 | # ── Preflight: Rust ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | install.sh | 996 | # ── Preflight: 32-bit ARM ──────────────────────────────────────── | COMMENT |
| MEDIUM | install.sh | 1011 | # ── Build feature flags ────────────────────────────────────────── | COMMENT |
| MEDIUM | install.sh | 1099 | # ── Detect existing installs ────────────────────────────────────── | COMMENT |
| MEDIUM | install.sh | 1129 | # ── Build profile RAM heuristic (Linux low-mem hosts) ───────────── | COMMENT |
| MEDIUM | install.sh | 1133 | # ── Build and install ───────────────────────────────────────────── | COMMENT |
| MEDIUM | install.sh | 1169 | # ── Web dashboard (gateway feature only) ────────────────────────── | COMMENT |
| MEDIUM | install.sh | 1197 | # ── Apps (standalone binaries under apps/<dir>) ────────────────── | COMMENT |
| MEDIUM | install.sh | 1259 | # ── Summary ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | install.sh | 1293 | # ── PATH setup ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | install.sh | 1344 | # ── Quickstart prompt ───────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | crates/zeroclaw-tool-call-parser/src/lib.rs | 5250 | // ═══════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM⚡ | crates/zeroclaw-tool-call-parser/src/lib.rs | 5252 | // ═══════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM⚡ | crates/zeroclaw-tool-call-parser/src/lib.rs | 5255 | // ═══════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | crates/zeroclaw-memory/src/sqlite.rs | 2659 | // ── FTS5 search tests ──────────────────────────────────────── | COMMENT |
| MEDIUM | crates/zeroclaw-memory/src/sqlite.rs | 2760 | // ── Embedding cache tests ──────────────────────────────────── | COMMENT |
| MEDIUM | crates/zeroclaw-memory/src/sqlite.rs | 2776 | // ── Schema tests ───────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/zeroclaw-memory/src/sqlite.rs | 2816 | // ── FTS5 sync trigger tests ────────────────────────────────── | COMMENT |
| MEDIUM | crates/zeroclaw-memory/src/sqlite.rs | 2902 | // ── Open timeout tests ──────────────────────────────────────── | COMMENT |
| MEDIUM | crates/zeroclaw-memory/src/sqlite.rs | 2951 | // ── Graceful degrade on embedding failure ──────────────────── | COMMENT |
| MEDIUM | crates/zeroclaw-memory/src/sqlite.rs | 3003 | // ── Embedder hot-swap──────────────────────────────── | COMMENT |
| MEDIUM | crates/zeroclaw-memory/src/sqlite.rs | 3544 | // ── With-embedder constructor test ─────────────────────────── | COMMENT |
| MEDIUM | crates/zeroclaw-memory/src/sqlite.rs | 3564 | // ── Reindex test ───────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/zeroclaw-memory/src/sqlite.rs | 3585 | // ── Embedding identity primitives────────────── | COMMENT |
| MEDIUM | crates/zeroclaw-memory/src/sqlite.rs | 3712 | // ── Recall limit test ──────────────────────────────────────── | COMMENT |
| MEDIUM | crates/zeroclaw-memory/src/sqlite.rs | 3735 | // ── Score presence test ────────────────────────────────────── | COMMENT |
| MEDIUM | crates/zeroclaw-memory/src/sqlite.rs | 3751 | // ── Edge cases: FTS5 special characters ────────────────────── | COMMENT |
| MEDIUM | crates/zeroclaw-memory/src/sqlite.rs | 3887 | // ── Edge cases: store ──────────────────────────────────────── | COMMENT |
| MEDIUM | crates/zeroclaw-memory/src/sqlite.rs | 3946 | // ── Edge cases: recall ─────────────────────────────────────── | COMMENT |
| MEDIUM | crates/zeroclaw-memory/src/sqlite.rs | 4012 | // ── Edge cases: schema idempotency ─────────────────────────── | COMMENT |
| MEDIUM | crates/zeroclaw-memory/src/sqlite.rs | 4044 | // ── Edge cases: forget + FTS5 consistency ──────────────────── | COMMENT |
| MEDIUM | crates/zeroclaw-memory/src/sqlite.rs | 4083 | // ── Edge cases: reindex ────────────────────────────────────── | COMMENT |
| MEDIUM | crates/zeroclaw-memory/src/sqlite.rs | 4106 | // ── Edge cases: content_hash ───────────────────────────────── | COMMENT |
| MEDIUM | crates/zeroclaw-memory/src/sqlite.rs | 4131 | // ── Edge cases: category helpers ───────────────────────────── | COMMENT |
| MEDIUM | crates/zeroclaw-memory/src/sqlite.rs | 4151 | // ── Edge cases: list ───────────────────────────────────────── | COMMENT |
| MEDIUM | crates/zeroclaw-memory/src/sqlite.rs | 4190 | // ── Bulk deletion tests ─────────────────────────────────────── | COMMENT |
| MEDIUM | crates/zeroclaw-memory/src/sqlite.rs | 4288 | // ── Session isolation ───────────────────────────────────────── | COMMENT |
| MEDIUM | crates/zeroclaw-memory/src/sqlite.rs | 4771 | // ── §4.1 Concurrent write contention tests ────────────── | COMMENT |
| 1838 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | Cargo.toml | 161 | COMMENT | |
| LOW | Cargo.toml | 341 | # support at all — no plugin runtime, no WASM dependencies, and the plugin ABI | COMMENT |
| LOW | deny.toml | 1 | # cargo-deny configuration -- v2 schema | COMMENT |
| LOW | clippy.toml | 1 | # Clippy configuration for ZeroClaw. | COMMENT |
| LOW | clippy.toml | 41 | # `anyhow::Error::msg`, or a typed error. Do not sidestep this by | COMMENT |
| LOW | clippy.toml | 61 | # They are NOT in disallowed-macros yet because ~430 existing violations across | COMMENT |
| LOW | docker-compose.yml | 1 | # ZeroClaw Docker Compose Example | COMMENT |
| LOW | docker-compose.yml | 21 | # dockerfile: Dockerfile.debian | COMMENT |
| LOW | docker-compose.yml | 41 | # this. `allow_public_bind` only acknowledges the non-loopback listener | COMMENT |
| LOW | demo/docker-compose.yml | 21 | # - esp32_sim example + visualizer | COMMENT |
| LOW | crates/zeroclaw-tool-call-parser/src/lib.rs | 41 | /// (`zeroclaw-runtime`'s `StreamTerminalMarkerStripper`) so a vocabulary or | COMMENT |
| LOW | crates/zeroclaw-tool-call-parser/src/lib.rs | 61 | /// assert_eq!(strip_trailing_terminal_markers("Summary<eom><|eom|>"), "Summary"); | COMMENT |
| LOW | crates/zeroclaw-tool-call-parser/src/lib.rs | 1881 | COMMENT | |
| LOW | crates/zeroclaw-tool-call-parser/src/lib.rs | 1901 | if map.contains_key("description") || map.contains_key("parameters") { | COMMENT |
| LOW | crates/zeroclaw-tool-call-parser/src/lib.rs | 1921 | // nested content: | COMMENT |
| LOW | crates/zeroclaw-tool-call-parser/src/lib.rs | 1941 | /// | COMMENT |
| LOW | crates/zeroclaw-tool-call-parser/src/lib.rs | 1961 | /// arguments routinely carry markup, so quoted tag text must never delimit. | COMMENT |
| LOW | crates/zeroclaw-tool-call-parser/src/lib.rs | 2061 | body_end: after_open.len(), | COMMENT |
| LOW | crates/zeroclaw-memory/src/scanned.rs | 1 | //! Write- and read-boundary content screening for durable memory. | COMMENT |
| LOW | crates/zeroclaw-memory/src/normalize.rs | 1 | //! Score normalization helpers for recall candidates. | COMMENT |
| LOW | crates/zeroclaw-memory/src/lib.rs | 221 | let normalized = key.trim().to_ascii_lowercase(); | COMMENT |
| LOW | crates/zeroclaw-memory/src/lib.rs | 961 | RetrievalConfig { | COMMENT |
| LOW | crates/zeroclaw-memory/src/retrieval.rs | 1 | //! Optional read-cache decorator over a single backend recall. | COMMENT |
| LOW | crates/zeroclaw-memory/src/threat.rs | 1 | //! Content scanning for durable memory entries. | COMMENT |
| LOW | crates/zeroclaw-config/src/policy.rs | 341 | /// from cross-agent `AccessMode::Read` grants at policy | COMMENT |
| LOW | crates/zeroclaw-config/src/policy.rs | 361 | /// allowed set comes from `allowed_tools` or from the unrestricted | COMMENT |
| LOW | crates/zeroclaw-config/src/policy.rs | 621 | /// forbidden path nested under an allowed root takes effect, while a broad | COMMENT |
| LOW | crates/zeroclaw-config/src/policy.rs | 641 | /// entire `can_act` and approval flow, so silent escalation here | COMMENT |
| LOW | crates/zeroclaw-config/src/policy.rs | 661 | /// Child drops a forbidden_paths entry the parent enforces. Subset | COMMENT |
| LOW | crates/zeroclaw-config/src/policy.rs | 1641 | return executable_path == allowed_path; | COMMENT |
| LOW | crates/zeroclaw-config/src/policy.rs | 1661 | /// for forms whose quote delimiters were removed). | COMMENT |
| LOW | crates/zeroclaw-config/src/policy.rs | 1681 | // Track each whitespace-delimited token so the bounded grammar can reject | COMMENT |
| LOW | crates/zeroclaw-config/src/policy.rs | 2721 | if !self.is_path_allowed_for_shell(candidate, dialect) { | COMMENT |
| LOW | crates/zeroclaw-config/src/policy.rs | 2881 | /// policy using the host platform's default shell syntax. | COMMENT |
| LOW | crates/zeroclaw-config/src/policy.rs | 2901 | /// runs IN the workspace: each workspace-relative path argument is also | COMMENT |
| LOW | crates/zeroclaw-config/src/policy.rs | 2961 | #[cfg(target_os = "windows")] | COMMENT |
| LOW | crates/zeroclaw-config/src/policy.rs | 4901 | assert!(!p.is_path_allowed(&tp_sys_sub("root/.bashrc"))); | COMMENT |
| LOW | crates/zeroclaw-config/src/presets.rs | 141 | COMMENT | |
| LOW | crates/zeroclaw-config/src/presets.rs | 301 | } | COMMENT |
| LOW | crates/zeroclaw-config/src/presets.rs | 321 | /// Model id written to `providers.models.<type>.<alias>.model` at | COMMENT |
| LOW | crates/zeroclaw-config/src/presets.rs | 341 | /// multiple aliases of the same channel type. | COMMENT |
| LOW | crates/zeroclaw-config/src/presets.rs | 361 | /// System prompt text. Sourced from the personality template | COMMENT |
| LOW | crates/zeroclaw-config/src/presets.rs | 381 | #[cfg_attr(feature = "schema-export", derive(schemars::JsonSchema))] | COMMENT |
| LOW | crates/zeroclaw-config/src/presets.rs | 401 | /// alias of an existing `runtime-profiles.<alias>`. | COMMENT |
| LOW | crates/zeroclaw-config/src/presets.rs | 421 | /// `[peer_groups.<name>]` table written at apply time. The `channel` | COMMENT |
| LOW | crates/zeroclaw-config/src/api_error.rs | 1 | //! Structured error type for the gateway HTTP CRUD surface and its CLI peer. | COMMENT |
| LOW | crates/zeroclaw-config/src/api_error.rs | 21 | /// JSON Patch operation type is not supported (`move` / `copy`). | COMMENT |
| LOW | crates/zeroclaw-config/src/multi_agent.rs | 21 | /// Write access only. Cross-agent `file_write` is permitted; reads are not. | COMMENT |
| LOW | crates/zeroclaw-config/src/multi_agent.rs | 41 | /// (`crates/zeroclaw-memory/src/postgres.rs`, feature `memory-postgres`). | COMMENT |
| LOW | crates/zeroclaw-config/src/multi_agent.rs | 61 | #[serde(skip_serializing_if = "Option::is_none")] | COMMENT |
| LOW | crates/zeroclaw-config/src/multi_agent.rs | 81 | pub backend: MemoryBackendKind, | COMMENT |
| LOW | crates/zeroclaw-config/src/multi_agent.rs | 101 | #[cfg_attr(feature = "schema-export", derive(schemars::JsonSchema))] | COMMENT |
| LOW | crates/zeroclaw-config/src/multi_agent.rs | 121 | /// `/model --agent <model>` on the agent this group is bound to. | COMMENT |
| LOW | crates/zeroclaw-config/src/multi_agent.rs | 141 | /// the host printed in advertised endpoints when A2A is fronted at a | COMMENT |
| LOW | crates/zeroclaw-config/src/multi_agent.rs | 161 | pub server: A2aServerConfig, | COMMENT |
| LOW | crates/zeroclaw-config/src/sections.rs | 1 | //! Curated sections surface — a flat ordered set of [`Section`]s the | COMMENT |
| LOW | crates/zeroclaw-config/src/sections.rs | 21 | TypedFamilyMap, | COMMENT |
| LOW | crates/zeroclaw-config/src/sections.rs | 141 | #[cfg_attr(feature = "schema-export", derive(schemars::JsonSchema))] | COMMENT |
| LOW | crates/zeroclaw-config/src/helpers.rs | 61 | }; | COMMENT |
| LOW | crates/zeroclaw-config/src/scattered_types.rs | 281 | /// Defaults to `false` to match actual runtime behavior; | COMMENT |
| 817 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/fill-translations/src/main.rs | 698 | // Step 1: Run the production leak-repair path via the shared helper. | COMMENT |
| LOW | tools/fill-translations/src/main.rs | 716 | // Step 2: Simulate the trailing-`\n` pre-pass (same logic as main()). | COMMENT |
| LOW | tools/fill-translations/src/main.rs | 734 | // Step 3: write_po end-to-end — the final output must contain the | COMMENT |
| LOW | crates/zeroclaw-memory/src/sqlite.rs | 1848 | // Step 1: Rebuild FTS5 (always safe, cheap) | COMMENT |
| LOW | crates/zeroclaw-memory/src/sqlite.rs | 1859 | // Step 2: Re-embed memories with NULL vectors, if embedder is configured | COMMENT |
| LOW | crates/zeroclaw-tools/src/linkedin_client.rs | 601 | // Step 1: Register upload | COMMENT |
| LOW | crates/zeroclaw-tools/src/linkedin_client.rs | 653 | // Step 2: Upload binary | COMMENT |
| LOW⚡ | crates/zeroclaw-providers/src/bedrock.rs | 217 | // Step 1: get IMDSv2 token | COMMENT |
| LOW⚡ | crates/zeroclaw-providers/src/bedrock.rs | 226 | // Step 2: get IAM role name | COMMENT |
| LOW | crates/zeroclaw-providers/src/bedrock.rs | 237 | // Step 3: get credentials for that role | COMMENT |
| LOW | crates/zeroclaw-providers/src/bedrock.rs | 284 | // Step 4: get region from instance identity document | COMMENT |
| LOW | crates/zeroclaw-channels/src/lark.rs | 6895 | // Step 1: fast-ack POSTs 👀 and writes (om_dedupe, "👀") → R1. | COMMENT |
| LOW | crates/zeroclaw-channels/src/matrix.rs | 1401 | // Step 1: restore an existing session, or fresh-login. | COMMENT |
| LOW | crates/zeroclaw-channels/src/transcription.rs | 490 | // Step 1: Upload the audio file. | COMMENT |
| LOW | crates/zeroclaw-channels/src/transcription.rs | 516 | // Step 2: Create transcription job. | COMMENT |
| LOW | crates/zeroclaw-channels/src/transcription.rs | 549 | // Step 3: Poll for completion. | COMMENT |
| LOW | crates/zeroclaw-runtime/src/sop/engine.rs | 9503 | // Step 1: WaitApproval | COMMENT |
| LOW⚡ | crates/zeroclaw-runtime/src/agent/agent.rs | 10600 | // Step 1: filter excluded tools (mirrors from_config logic) | COMMENT |
| LOW⚡ | crates/zeroclaw-runtime/src/agent/agent.rs | 10604 | // Step 2: register skill tools (mirrors from_config logic) | COMMENT |
| LOW⚡ | crates/zeroclaw-runtime/src/daemon/mod.rs | 1557 | // Step 3: merged set, sorted by name for determinism. | COMMENT |
| LOW⚡ | crates/zeroclaw-runtime/src/daemon/mod.rs | 1562 | // Step 4: identity-stable no-churn check. If the merged set is | COMMENT |
| LOW | crates/zeroclaw-runtime/src/daemon/mod.rs | 1532 | // Step 1: split current into healthy (kept) and dead (dropped / | COMMENT |
| LOW | crates/zeroclaw-runtime/src/daemon/mod.rs | 1545 | // Step 2: identify the slice of `fresh` that is NOT already | COMMENT |
| LOW | crates/zeroclaw-runtime/src/daemon/mod.rs | 1611 | // Step 5: when the merged set is exactly `fresh`'s server set | COMMENT |
| LOW | crates/zeroclaw-runtime/src/daemon/mod.rs | 1630 | // Step 6: build the new registry from the merged handles. | COMMENT |
| LOW⚡ | tests/integration/memory_loop_continuity.rs | 205 | // Step 1: tool call | COMMENT |
| LOW⚡ | tests/integration/memory_loop_continuity.rs | 212 | // Step 2: another tool call | COMMENT |
| LOW⚡ | tests/integration/memory_loop_continuity.rs | 219 | // Step 3: final text | COMMENT |
| LOW | .claude/skills/github-pr/SKILL.md | 46 | ### Step 1: Gather Context | COMMENT |
| LOW | .claude/skills/github-pr/SKILL.md | 85 | ### Step 2: Pre-Fill the Template | COMMENT |
| LOW | .claude/skills/github-pr/SKILL.md | 99 | ### Step 3: Present Draft for Review | COMMENT |
| LOW | .claude/skills/github-pr/SKILL.md | 115 | ### Step 4: Push and Create | COMMENT |
| LOW | .claude/skills/github-pr/SKILL.md | 141 | ### Step 1: Identify the PR | COMMENT |
| LOW | .claude/skills/github-pr/SKILL.md | 157 | ### Step 2: Fetch Current State | COMMENT |
| LOW | .claude/skills/github-pr/SKILL.md | 173 | ### Step 3: Determine What to Update | COMMENT |
| LOW | .claude/skills/github-pr/SKILL.md | 188 | ### Step 4: Handle Body Section Edits | COMMENT |
| LOW | .claude/skills/github-pr/SKILL.md | 197 | ### Step 5: Smart Update After New Commits | COMMENT |
| LOW | .claude/skills/github-pr/SKILL.md | 217 | ### Step 6: Apply Updates | COMMENT |
| LOW | .claude/skills/github-pr/SKILL.md | 237 | ### Step 7: Confirm | COMMENT |
| LOW | .claude/skills/squash-merge/SKILL.md | 45 | ### Step 1: Resolve the PR and Run Pre-flight Checks | COMMENT |
| LOW | .claude/skills/squash-merge/SKILL.md | 151 | ### Step 2: Get Commit History | COMMENT |
| LOW | .claude/skills/squash-merge/SKILL.md | 184 | ### Step 3: Derive the Squash Commit Subject | COMMENT |
| LOW | .claude/skills/squash-merge/SKILL.md | 206 | ### Step 4: Confirm — MANDATORY, NO EXCEPTIONS | COMMENT |
| LOW | .claude/skills/squash-merge/SKILL.md | 242 | ### Step 5: Execute | COMMENT |
| LOW | .claude/skills/squash-merge/SKILL.md | 255 | ### Step 6: Verify | COMMENT |
| LOW | .claude/skills/squash-merge/SKILL.md | 273 | ### Step 7: Public Tracker Follow-Through | COMMENT |
| LOW | .claude/skills/github-issue/SKILL.md | 13 | ### Step 1: Route the Request and Read the Template | COMMENT |
| LOW | .claude/skills/github-issue/SKILL.md | 37 | ### Step 2: Auto-Gather Context | COMMENT |
| LOW | .claude/skills/github-issue/SKILL.md | 57 | ### Step 3: Pre-Fill and Present the Form | COMMENT |
| LOW | .claude/skills/github-issue/SKILL.md | 87 | ### Step 4: Scope Guard | COMMENT |
| LOW | .claude/skills/github-issue/SKILL.md | 102 | ### Step 5: Construct Issue Body | COMMENT |
| LOW | .claude/skills/github-issue/SKILL.md | 131 | ### Step 6: Final Preview and Submit | COMMENT |
| LOW | .claude/skills/feature-matrix-parity/SKILL.md | 74 | ### Step 1: Read the live page for ground truth | COMMENT |
| LOW | .claude/skills/feature-matrix-parity/SKILL.md | 90 | ### Step 2: Shallow-clone both competitors | COMMENT |
| LOW | .claude/skills/feature-matrix-parity/SKILL.md | 107 | ### Step 3: Walk every row against real modules | COMMENT |
| LOW | .claude/skills/feature-matrix-parity/SKILL.md | 127 | ### Step 4: Check the issue tracker for `planned` verdicts | COMMENT |
| LOW | .claude/skills/feature-matrix-parity/SKILL.md | 151 | ### Step 5: Write the TOML | COMMENT |
| LOW | .claude/skills/feature-matrix-parity/SKILL.md | 161 | ### Step 6: Verify with the guard test | COMMENT |
| LOW | .claude/skills/feature-matrix-parity/SKILL.md | 173 | ### Step 7: Regenerate and confirm live | COMMENT |
| LOW | .claude/skills/feature-matrix-parity/SKILL.md | 185 | ### Step 8: Clean up and commit | COMMENT |
| 55 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | crates/zeroclaw-providers/src/auth/mod.rs | 1537 | let alias_cfg = ctx.config.providers.models.gemini.get(alias_name); | CODE |
| CRITICAL | crates/zeroclaw-runtime/src/agent/cost.rs | 65 | for (provider_type, _model_id, _rates) in config.cost.rates.providers.models.iter_entries() { | CODE |
| CRITICAL | crates/zeroclaw-runtime/src/agent/cost.rs | 106 | for (rate_provider_type, model_id, rates) in config.cost.rates.providers.models.iter_entries() { | CODE |
| CRITICAL | crates/zeroclaw-runtime/src/agent/cost.rs | 856 | config.cost.rates.providers.models.deepseek.insert( | CODE |
| CRITICAL | crates/zeroclaw-runtime/src/agent/cost.rs | 940 | config.cost.rates.providers.models.deepseek.insert( | CODE |
| CRITICAL | crates/zeroclaw-runtime/src/rpc/dispatch.rs | 8640 | cfg.cost.rates.providers.models.openai.insert( | CODE |
| CRITICAL | crates/zeroclaw-runtime/src/rpc/dispatch.rs | 8647 | cfg.cost.rates.providers.models.openai.insert( | CODE |
| CRITICAL | tests/component/config_patch_cli.rs | 670 | cfg.cost.rates.providers.models.openai.is_empty(), | CODE |
| CRITICAL | tests/component/config_patch_cli.rs | 702 | let keys: Vec<&String> = cfg.cost.rates.providers.models.openai.keys().collect(); | CODE |
| CRITICAL | docs/book/src/ops/cost-tracking.md | 62 | `config.cost.rates.providers.models.iter_entries()` and merges the | CODE |
| CRITICAL | apps/zerocode/src/config/mod.rs | 1486 | assert!(c.connection.wss.tls.skip_verify_routes.is_empty()); | CODE |
| CRITICAL | apps/zerocode/src/config/mod.rs | 1489 | assert!(parsed.connection.wss.tls.skip_verify_routes.is_empty()); | CODE |
| CRITICAL | src/main.rs | 10615 | config.cost.rates.providers.models.openai.is_empty(), | CODE |
| CRITICAL | src/main.rs | 10813 | assert!(config.cost.rates.providers.models.openai.is_empty()); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | firmware/esp32-ui/src/main.rs | 1 | //! ZeroClaw ESP32 UI firmware scaffold. | COMMENT |
| MEDIUM | crates/zeroclaw-config/src/skill_bundles.rs | 48 | /// Reject directories that escape `<install>/shared/`. Run at scaffold time | COMMENT |
| MEDIUM | crates/zeroclaw-tools/src/model_routing_config.rs | 950 | // synthesize runtime_profiles[name] from agentic/max_iterations/max_depth. | COMMENT |
| MEDIUM | crates/zeroclaw-providers/src/compatible.rs | 7274 | let json = r#"{"content":null,"reasoning":"chain-of-thought via vllm","tool_calls":null}"#; | CODE |
| MEDIUM | crates/zeroclaw-providers/src/reliable.rs | 234 | /// A fallback scope can span an agentic tool loop, which issues several model | COMMENT |
| MEDIUM | crates/zeroclaw-macros/src/lib.rs | 2059 | // leaving a partial sub-table that fails strict reload. The scaffold | COMMENT |
| MEDIUM | crates/zeroclaw-macros/src/lib.rs | 2078 | /// bare/ancestor-prefix `init_defaults` scaffold must not | COMMENT |
| MEDIUM | crates/zeroclaw-channels/src/transcription.rs | 2217 | // Step 2 — the real scaffold: no handcrafted struct assignment. | COMMENT |
| MEDIUM | crates/zeroclaw-runtime/src/tools/delegate.rs | 127 | /// Parent tool registry for agentic sub-agents. | COMMENT |
| MEDIUM | crates/zeroclaw-runtime/src/tools/delegate.rs | 130 | /// agentic delegation. | COMMENT |
| MEDIUM | crates/zeroclaw-runtime/src/tools/delegate.rs | 146 | /// named runtime profiles for agentic/tools/iteration resolution. | COMMENT |
| MEDIUM | crates/zeroclaw-runtime/src/tools/delegate.rs | 339 | /// independent agentic delegation. | COMMENT |
| MEDIUM | crates/zeroclaw-runtime/src/tools/delegate.rs | 411 | /// Attach runtime profiles for agentic/tools/iteration resolution. | COMMENT |
| MEDIUM | crates/zeroclaw-runtime/src/tools/delegate.rs | 895 | /// Resolve agentic run timeout from the named runtime profile. | COMMENT |
| MEDIUM | crates/zeroclaw-runtime/src/tools/delegate.rs | 905 | /// Resolve agentic mode flag from the named runtime profile (default: false). | COMMENT |
| MEDIUM | crates/zeroclaw-runtime/src/tools/delegate.rs | 1405 | // Build enriched system prompt for non-agentic sub-agent. | COMMENT |
| MEDIUM | crates/zeroclaw-runtime/src/tools/delegate.rs | 4590 | // still a valid agentic run. The fallback is a tool-less loop, not a | COMMENT |
| MEDIUM | crates/zeroclaw-runtime/src/tools/delegate.rs | 4616 | // filters every candidate out, agentic execution should continue without | COMMENT |
| MEDIUM | crates/zeroclaw-runtime/src/tools/delegate.rs | 4862 | // rebuilds a delegate tool instance before entering the agentic loop. | COMMENT |
| MEDIUM | crates/zeroclaw-runtime/src/tools/delegate.rs | 5180 | // Recursive agentic delegation is still unsupported. Even if the target | COMMENT |
| MEDIUM | crates/zeroclaw-runtime/src/tools/delegate.rs | 7908 | // has a wider runtime policy. Bounded agentic execution applies the | COMMENT |
| MEDIUM | crates/zeroclaw-runtime/src/tools/delegate.rs | 7997 | // the caller's filtered tool registry still remains the agentic ceiling. | COMMENT |
| MEDIUM | crates/zeroclaw-runtime/src/tools/delegate.rs | 8413 | // agentic delegation must ignore that parent ceiling and build the | COMMENT |
| MEDIUM | crates/zeroclaw-runtime/src/tools/mod.rs | 684 | // Independent agentic delegates use it later to build the target-owned tool | COMMENT |
| MEDIUM | crates/zeroclaw-runtime/src/agent/turn/mod.rs | 95 | /// Default maximum agentic tool-use iterations per user message to prevent runaway loops. | COMMENT |
| MEDIUM | crates/zeroclaw-runtime/src/skills/constants.rs | 1 | //! Canonical filenames + scaffold subdirs for the Agent Skills spec. | COMMENT |
| MEDIUM | crates/zeroclaw-runtime/src/skills/scaffold.rs | 43 | #[error("failed to write skill scaffold: {0}")] | COMMENT |
| MEDIUM | crates/zeroclaw-runtime/src/rpc/dispatch.rs | 10912 | /// Shared blocking scaffold: hold `config_write_lock`, spawn the RPC | COMMENT |
| MEDIUM | web/src/components/sections/PersonalityEditor.tsx | 7 | // `agent` is reserved for #5890 (multi-agent workspaces). Today it is | COMMENT |
| MEDIUM | web/src/components/sections/SkillsBundleEditor.tsx | 2 | // bundle's resolved directory, scaffold new ones (strict-spec: name + | COMMENT |
| MEDIUM | docs/book/src/hardware/adding-boards-and-tools.md | 37 | ## Adding a Datasheet (RAG) | COMMENT |
| MEDIUM | docs/book/src/hardware/hardware-peripherals-design.md | 115 | ### RAG Pipeline (Datasheet Retrieval) | COMMENT |
| MEDIUM | docs/book/src/agents/overview.md | 8 | {{#include ../_snippets/concept-multi-agent.md}} | CODE |
| MEDIUM | …ok/src/foundations/fnd-001-intentional-architecture.md | 37 | | 3 | 2026-04-10 | Terminology correction per implementation feedback from PR #5559: "kernel" → "runtime" for the agent | CODE |
| MEDIUM | …re/decisions/ADR-011-multi-agent-runtime-boundaries.md | 20 | Accepted RFC [#5890](https://github.com/zeroclaw-labs/zeroclaw/issues/5890) proposed a broader multi-agent UX and config | CODE |
| MEDIUM | docs/book/src/getting-started/concepts.md | 13 | {{#include ../_snippets/concept-multi-agent.md}} | CODE |
| MEDIUM | docs/book/src/ops/observability.md | 98 | ### Turn-nested memory and RAG spans (`observability-otel`) | COMMENT |
| MEDIUM | src/lib.rs | 495 | /// Open SKILL.md in $EDITOR after scaffold. | COMMENT |
| MEDIUM | src/skills/mod.rs | 769 | // Slash options are authored in the dashboard editor, not at scaffold time. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | crates/zeroclaw-infra/src/net_guard.rs | 1379 | "user@example.com", | CODE |
| LOW | crates/zeroclaw-infra/src/net_guard.rs | 1768 | assert!(normalize_domain("user@example.com").is_none()); | CODE |
| LOW | crates/zeroclaw-tools/src/image_gen.rs | 917 | unsafe { std::env::set_var("FAL_API_KEY_TEST_SIZE", "dummy_key") }; | CODE |
| LOW | crates/zeroclaw-tools/src/image_gen.rs | 965 | unsafe { std::env::set_var("FAL_API_KEY_TEST_MODEL", "dummy_key") }; | CODE |
| LOW | crates/zeroclaw-tools/src/git_operations.rs | 1064 | &["config", "user.email", "test@test.com"], | CODE |
| LOW | crates/zeroclaw-tools/src/jira_tool.rs | 2203 | ("acc-123".to_string(), "John Doe".to_string()), | CODE |
| LOW | crates/zeroclaw-tools/src/browser.rs | 1415 | "enum": ["role", "text", "label", "placeholder", "testid"], | CODE |
| LOW | crates/zeroclaw-tools/src/browser.rs | 1986 | "placeholder" => format!("[placeholder=\"{escaped}\"]"), | CODE |
| LOW | crates/zeroclaw-tools/src/browser.rs | 2232 | let sel = selector_for_find("placeholder", "Search"); | CODE |
| LOW | crates/zeroclaw-tools/src/microsoft365/graph_client.rs | 472 | let base = user_path("user@example.com"); | CODE |
| LOW⚡ | crates/zeroclaw-api/src/channel.rs | 1141 | reply_target: "user@example.com".into(), | CODE |
| LOW⚡ | crates/zeroclaw-api/src/channel.rs | 1144 | ..ChannelMessage::new("msg-001", "alice", "user@example.com", "", "email", 0) | CODE |
| LOW⚡ | crates/zeroclaw-api/src/channel.rs | 1147 | assert_eq!(reply.recipient, "user@example.com"); | CODE |
| LOW | crates/zeroclaw-api/src/channel.rs | 1158 | ..ChannelMessage::new("msg-002", "alice", "user@example.com", "", "email", 0) | CODE |
| LOW | crates/zeroclaw-api/src/channel.rs | 1176 | ..ChannelMessage::new("c", "alice", "user@example.com", "", "email", 0) | CODE |
| LOW | crates/zeroclaw-api/src/channel.rs | 1213 | let inbound = ChannelMessage::new("c", "alice", "user@example.com", "", "email", 0); | CODE |
| LOW | crates/zeroclaw-hardware/src/uf2.rs | 337 | msg.contains("placeholder") || msg.contains("UF2"), | CODE |
| LOW | crates/zeroclaw-providers/src/gemini.rs | 2530 | let model_provider = test_model_provider(Some(test_oauth_auth("fake_token"))); | CODE |
| LOW | crates/zeroclaw-channels/src/imessage.rs | 600 | assert!(is_valid_imessage_target("user@example.com")); | CODE |
| LOW | crates/zeroclaw-channels/src/imessage.rs | 805 | "INSERT INTO handle (ROWID, id) VALUES (2, 'user@example.com')", | CODE |
| LOW | crates/zeroclaw-channels/src/imessage.rs | 829 | "user@example.com".to_string(), | CODE |
| LOW | crates/zeroclaw-channels/src/telegram.rs | 4882 | "fake-token".into(), | CODE |
| LOW | crates/zeroclaw-channels/src/telegram.rs | 4931 | "fake-token".into(), | CODE |
| LOW | crates/zeroclaw-channels/src/telegram.rs | 5007 | "fake-token".into(), | CODE |
| LOW | crates/zeroclaw-channels/src/telegram.rs | 5028 | "fake-token".into(), | CODE |
| LOW | crates/zeroclaw-channels/src/telegram.rs | 5093 | "fake-token".into(), | CODE |
| LOW | crates/zeroclaw-channels/src/telegram.rs | 5106 | "fake-token".into(), | CODE |
| LOW | crates/zeroclaw-channels/src/telegram.rs | 5131 | "fake-token".into(), | CODE |
| LOW | crates/zeroclaw-channels/src/telegram.rs | 5156 | "fake-token".into(), | CODE |
| LOW | crates/zeroclaw-channels/src/telegram.rs | 5164 | "fake-token".into(), | CODE |
| LOW | crates/zeroclaw-channels/src/telegram.rs | 5199 | "fake-token".into(), | CODE |
| LOW | crates/zeroclaw-channels/src/telegram.rs | 5214 | "fake-token".into(), | CODE |
| LOW | crates/zeroclaw-channels/src/telegram.rs | 5231 | "fake-token".into(), | CODE |
| LOW | crates/zeroclaw-channels/src/telegram.rs | 5266 | "fake-token".into(), | CODE |
| LOW | crates/zeroclaw-channels/src/telegram.rs | 5313 | "fake-token".into(), | CODE |
| LOW | crates/zeroclaw-channels/src/telegram.rs | 5330 | "fake-token".into(), | CODE |
| LOW | crates/zeroclaw-channels/src/telegram.rs | 5346 | "fake-token".into(), | CODE |
| LOW | crates/zeroclaw-channels/src/telegram.rs | 5364 | "fake-token".into(), | CODE |
| LOW | crates/zeroclaw-channels/src/telegram.rs | 5384 | "fake-token".into(), | CODE |
| LOW | crates/zeroclaw-channels/src/telegram.rs | 5905 | "fake-token".into(), | CODE |
| LOW | crates/zeroclaw-channels/src/telegram.rs | 5945 | "fake-token".into(), | CODE |
| LOW | crates/zeroclaw-channels/src/telegram.rs | 5977 | "fake-token".into(), | CODE |
| LOW | crates/zeroclaw-channels/src/telegram.rs | 5999 | "fake-token".into(), | CODE |
| LOW | crates/zeroclaw-channels/src/telegram.rs | 6018 | "fake-token".into(), | CODE |
| LOW | crates/zeroclaw-channels/src/telegram.rs | 6040 | "fake-token".into(), | CODE |
| LOW | crates/zeroclaw-channels/src/telegram.rs | 6056 | "fake-token".into(), | CODE |
| LOW | crates/zeroclaw-channels/src/telegram.rs | 6072 | "fake-token".into(), | CODE |
| LOW | crates/zeroclaw-channels/src/telegram.rs | 6088 | "fake-token".into(), | CODE |
| LOW | crates/zeroclaw-channels/src/telegram.rs | 6222 | "fake-token".into(), | CODE |
| LOW | crates/zeroclaw-channels/src/telegram.rs | 6252 | "fake-token".into(), | CODE |
| LOW | crates/zeroclaw-channels/src/telegram.rs | 6298 | "fake-token".into(), | CODE |
| LOW | crates/zeroclaw-channels/src/telegram.rs | 6321 | "fake-token".into(), | CODE |
| LOW | crates/zeroclaw-channels/src/telegram.rs | 6340 | "fake-token".into(), | CODE |
| LOW | crates/zeroclaw-channels/src/telegram.rs | 9504 | "fake-token".into(), | CODE |
| LOW | crates/zeroclaw-channels/src/telegram.rs | 9854 | .credential(Some("fake_key")) | CODE |
| LOW | crates/zeroclaw-channels/src/telegram.rs | 10304 | "fake-token".into(), | CODE |
| LOW | crates/zeroclaw-channels/src/telegram.rs | 10386 | "fake-token".into(), | CODE |
| LOW | crates/zeroclaw-channels/src/telegram.rs | 10414 | "fake-token".into(), | CODE |
| LOW | crates/zeroclaw-channels/src/telegram.rs | 10527 | "fake-token".into(), | CODE |
| LOW | crates/zeroclaw-channels/src/telegram.rs | 10592 | "fake-token".into(), | CODE |
| 33 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | web/src/components/ToolPermissionGrid.logic.ts | 132 | export function isAlwaysAskWildcardLocked({ | CODE |
| LOW | web/src/components/ToolPermissionGrid.tsx | 261 | function autoApproveWildcardApplies(name: string): boolean { | CODE |
| LOW | web/src/components/sections/CostRatesEditor.tsx | 72 | async function applyCatalogPricingToResource( | CODE |
| LOW | web/src/components/sections/FieldForm.tsx | 661 | export function clearFieldFormCatalogCaches() { | CODE |
| LOW | web/src/lib/configuredModels.ts | 11 | export async function walkConfiguredModelBindings( | CODE |
| LOW | web/src/lib/configuredModels.ts | 53 | export async function resolveModelToProviderType( | CODE |
| LOW | web/src/lib/api.ts | 1344 | export function createAgentWorkspaceDirectory( | CODE |
| LOW | web/src/lib/ws.ts | 33 | export function getOrCreateSessionId(agentAlias: string): string { | CODE |
| LOW | web/src/lib/chatHistoryStorage.ts | 46 | export function mapServerMessagesToPersisted(rows: SessionMessageRow[]): PersistedChatBubble[] { | CODE |
| LOW | web/src/lib/validationWarnings.test.ts | 4 | async function loadValidationWarningMessage() { | CODE |
| LOW | web/src/lib/modelProviders.ts | 20 | export function primeModelProviderCatalog(): Promise<void> { | CODE |
| LOW | web/src/pages/Cron.tsx | 67 | function describeCronSettingsError(err: unknown) { | CODE |
| LOW | web/src/pages/quickstart/runtime-selection.ts | 13 | export function runtimeDefaultForProvider( | CODE |
| LOW | web/src/pages/quickstart/runtime-selection.ts | 24 | export function runtimeAfterProviderChange( | CODE |
| LOW | web/src/pages/quickstart/runtime-selection.ts | 41 | export function requiredQuickstartSelectionsComplete(input: { | CODE |
| LOW⚡ | tests/manual/telegram/generate_test_messages.py | 21 | def generate_exact_limit_message(): | CODE |
| LOW⚡ | tests/manual/telegram/generate_test_messages.py | 26 | def generate_over_limit_message(): | CODE |
| LOW⚡ | tests/manual/telegram/generate_test_messages.py | 30 | def generate_multi_chunk_message(): | CODE |
| LOW⚡ | tests/manual/telegram/generate_test_messages.py | 38 | def generate_word_boundary_message(): | CODE |
| LOW | scripts/ci/lru_advisory_scope_test.py | 26 | def validate_version_boundary() -> None: | CODE |
| LOW | scripts/ci/collect_changed_links.py | 141 | def mdbook_link_escapes_source(source_path: str, target: str) -> bool: | CODE |
| LOW⚡ | scripts/ci/collect_changed_links_test.py | 65 | def test_rejects_repository_relative_target_outside_book_source(self) -> None: | CODE |
| LOW⚡ | scripts/ci/collect_changed_links_test.py | 72 | def test_accepts_target_within_book_source(self) -> None: | CODE |
| LOW⚡ | scripts/ci/collect_changed_links_test.py | 79 | def test_does_not_apply_book_boundary_to_other_repository_docs(self) -> None: | CODE |
| LOW | scripts/ci/collect_changed_links_test.py | 92 | def test_cli_rejects_mdbook_link_outside_source_root(self) -> None: | CODE |
| LOW | scripts/ci/collect_changed_links_test.py | 108 | def test_cli_accepts_repository_link_outside_book(self) -> None: | CODE |
| LOW | scripts/ci/release_attestation_contract_test.py | 47 | def test_redundant_release_signing_paths_are_absent(self) -> None: | CODE |
| LOW | scripts/ci/release_attestation_contract_test.py | 59 | def test_publish_keeps_required_attestation_permissions(self) -> None: | CODE |
| LOW | scripts/ci/release_attestation_contract_test.py | 63 | def test_sboms_are_read_only_inputs_to_publish(self) -> None: | CODE |
| LOW⚡ | scripts/ci/release_attestation_contract_test.py | 79 | def test_payload_attestation_is_pinned_and_best_effort(self) -> None: | CODE |
| LOW⚡ | scripts/ci/release_attestation_contract_test.py | 85 | def test_direct_attestation_action_is_used_exactly_three_times(self) -> None: | CODE |
| LOW⚡ | scripts/ci/release_attestation_contract_test.py | 89 | def test_archive_is_built_only_from_verified_offline_material(self) -> None: | CODE |
| LOW | scripts/ci/release_attestation_contract_test.py | 106 | def test_verification_archive_is_staged_and_validated_before_publication(self) -> None: | CODE |
| LOW | scripts/ci/release_attestation_contract_test.py | 122 | def test_final_checksums_follow_archive_and_are_never_rewritten(self) -> None: | CODE |
| LOW | scripts/ci/release_attestation_contract_test.py | 135 | def test_final_metadata_has_dedicated_attestations(self) -> None: | CODE |
| LOW | scripts/ci/release_attestation_contract_test.py | 149 | def test_release_uploads_only_the_consolidated_asset_directory(self) -> None: | CODE |
| LOW | scripts/ci/release_attestation_contract_test.py | 153 | def test_cosign_remains_for_ghcr_images_only(self) -> None: | CODE |
| LOW⚡ | scripts/github/project_dashboard_plan_test.py | 32 | def test_contract_rules_emit_only_fnd_project_status_values(self) -> None: | CODE |
| LOW⚡ | scripts/github/project_dashboard_plan_test.py | 38 | def test_load_issue_from_event_accepts_event_and_issue_json(self) -> None: | CODE |
| LOW⚡ | scripts/github/project_dashboard_plan_test.py | 48 | def test_label_names_accepts_string_and_object_labels(self) -> None: | CODE |
| LOW⚡ | scripts/github/project_dashboard_plan_test.py | 52 | def test_not_planned_closed_issue_maps_to_wont_do_before_open_conflicts(self) -> None: | CODE |
| LOW⚡ | scripts/github/project_dashboard_plan_test.py | 63 | def test_closed_issue_without_terminal_signal_maps_to_done(self) -> None: | CODE |
| LOW⚡ | scripts/github/project_dashboard_plan_test.py | 67 | def test_in_progress_label_maps_to_in_review(self) -> None: | CODE |
| LOW⚡ | scripts/github/project_dashboard_plan_test.py | 71 | def test_blocked_no_stale_issue_is_a_conflict(self) -> None: | CODE |
| LOW⚡ | scripts/github/project_dashboard_plan_test.py | 77 | def test_open_conflict_uses_backlog_with_low_confidence(self) -> None: | CODE |
| LOW⚡ | scripts/github/project_dashboard_plan_test.py | 83 | def test_no_stale_with_in_progress_is_a_conflict(self) -> None: | CODE |
| LOW⚡ | scripts/github/project_dashboard_plan_test.py | 89 | def test_blocked_pickup_labels_are_a_conflict(self) -> None: | CODE |
| LOW⚡ | scripts/github/project_dashboard_plan_test.py | 95 | def test_contract_rejects_unknown_status(self) -> None: | CODE |
| LOW⚡ | scripts/github/project_dashboard_plan_test.py | 101 | def test_contract_requires_open_and_closed_catchalls(self) -> None: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | demo/docker-compose.yml | 17 | # This harness completes the split of the original #6148 bundle. | COMMENT |
| MEDIUM | crates/zeroclaw-hardware/src/serial.rs | 129 | // Match on the error kind for robust cross-platform disconnect detection. | COMMENT |
| MEDIUM | crates/zeroclaw-channels/src/matrix.rs | 9404 | // Construct via Default + struct update so we stay robust to | COMMENT |
| MEDIUM | crates/zeroclaw-runtime/src/agent/loop_.rs | 15610 | // assert each field == scrub_for_export(raw) (robust regardless of exact regex). | COMMENT |
| LOW | .github/workflows/release-stable-manual.yml | 1035 | # For tag push, the tag already exists — just create the release. | COMMENT |
| MEDIUM | .github/workflows/ci.yml | 429 | # `cargo test` accepts only one positional TESTNAME; the harness ORs them. | COMMENT |
| MEDIUM⚡ | dev/test-harness.sh | 5 | # Validates the 9-phase harness implementation: | COMMENT |
| MEDIUM⚡ | dev/test-harness.sh | 13 | # docker exec zeroclaw-dev bash /zeroclaw-data/workspace/test-harness.sh | COMMENT |
| MEDIUM⚡ | dev/test-harness.sh | 14 | # or: ./dev/test-harness.sh (if running on host with gateway at localhost:42617) | COMMENT |
| MEDIUM⚡ | dev/test-harness.sh | 141 | # TEST 6: Tools List (verify harness tools present) | COMMENT |
| MEDIUM⚡ | dev/test-harness.sh | 183 | # TEST 8: Config Verification (harness features enabled) | COMMENT |
| MEDIUM | dev/run-tauri-dev.sh | 21 | # Prefer the Tauri CLI (hot-reload, proper dev harness). Fall back to a plain | COMMENT |
| MEDIUM | dev/ci.sh | 105 | # harness's default process model). | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/fill-translations/src/main.rs | 698 | // Step 1: Run the production leak-repair path via the shared helper. | COMMENT |
| LOW | tools/fill-translations/src/main.rs | 716 | // Step 2: Simulate the trailing-`\n` pre-pass (same logic as main()). | COMMENT |
| LOW | tools/fill-translations/src/main.rs | 734 | // Step 3: write_po end-to-end — the final output must contain the | COMMENT |
| LOW | crates/zeroclaw-memory/src/sqlite.rs | 1848 | // Step 1: Rebuild FTS5 (always safe, cheap) | COMMENT |
| LOW | crates/zeroclaw-memory/src/sqlite.rs | 1859 | // Step 2: Re-embed memories with NULL vectors, if embedder is configured | COMMENT |
| LOW | crates/zeroclaw-tools/src/linkedin_client.rs | 601 | // Step 1: Register upload | COMMENT |
| LOW | crates/zeroclaw-tools/src/linkedin_client.rs | 653 | // Step 2: Upload binary | COMMENT |
| LOW⚡ | crates/zeroclaw-providers/src/bedrock.rs | 217 | // Step 1: get IMDSv2 token | COMMENT |
| LOW⚡ | crates/zeroclaw-providers/src/bedrock.rs | 226 | // Step 2: get IAM role name | COMMENT |
| LOW | crates/zeroclaw-providers/src/bedrock.rs | 237 | // Step 3: get credentials for that role | COMMENT |
| LOW | crates/zeroclaw-providers/src/bedrock.rs | 284 | // Step 4: get region from instance identity document | COMMENT |
| LOW | crates/zeroclaw-channels/src/lark.rs | 6895 | // Step 1: fast-ack POSTs 👀 and writes (om_dedupe, "👀") → R1. | COMMENT |
| LOW | crates/zeroclaw-channels/src/matrix.rs | 1401 | // Step 1: restore an existing session, or fresh-login. | COMMENT |
| LOW | crates/zeroclaw-channels/src/transcription.rs | 490 | // Step 1: Upload the audio file. | COMMENT |
| LOW | crates/zeroclaw-channels/src/transcription.rs | 516 | // Step 2: Create transcription job. | COMMENT |
| LOW | crates/zeroclaw-channels/src/transcription.rs | 549 | // Step 3: Poll for completion. | COMMENT |
| LOW | crates/zeroclaw-runtime/src/sop/engine.rs | 9503 | // Step 1: WaitApproval | COMMENT |
| LOW⚡ | crates/zeroclaw-runtime/src/agent/agent.rs | 10600 | // Step 1: filter excluded tools (mirrors from_config logic) | COMMENT |
| LOW⚡ | crates/zeroclaw-runtime/src/agent/agent.rs | 10604 | // Step 2: register skill tools (mirrors from_config logic) | COMMENT |
| LOW⚡ | crates/zeroclaw-runtime/src/daemon/mod.rs | 1557 | // Step 3: merged set, sorted by name for determinism. | COMMENT |
| LOW⚡ | crates/zeroclaw-runtime/src/daemon/mod.rs | 1562 | // Step 4: identity-stable no-churn check. If the merged set is | COMMENT |
| LOW | crates/zeroclaw-runtime/src/daemon/mod.rs | 1532 | // Step 1: split current into healthy (kept) and dead (dropped / | COMMENT |
| LOW | crates/zeroclaw-runtime/src/daemon/mod.rs | 1545 | // Step 2: identify the slice of `fresh` that is NOT already | COMMENT |
| LOW | crates/zeroclaw-runtime/src/daemon/mod.rs | 1611 | // Step 5: when the merged set is exactly `fresh`'s server set | COMMENT |
| LOW | crates/zeroclaw-runtime/src/daemon/mod.rs | 1630 | // Step 6: build the new registry from the merged handles. | COMMENT |
| LOW⚡ | tests/integration/memory_loop_continuity.rs | 205 | // Step 1: tool call | COMMENT |
| LOW⚡ | tests/integration/memory_loop_continuity.rs | 212 | // Step 2: another tool call | COMMENT |
| LOW⚡ | tests/integration/memory_loop_continuity.rs | 219 | // Step 3: final text | COMMENT |
| LOW | xtask/src/cmd/mdbook/sync.rs | 31 | // Step 1: extract English msgids | COMMENT |
| LOW | src/main.rs | 1632 | // Step 1: pick Existing or Fresh, when there are | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | firmware/uno-q-bridge/python/main.py | 33 | except Exception as e: | CODE |
| LOW | firmware/uno-q-bridge/python/main.py | 36 | except Exception: | CODE |
| LOW | firmware/uno-q-bridge/python/main.py | 48 | except Exception: | CODE |
| MEDIUM | firmware/uno-q-bridge/python/main.py | 10 | def handle_client(conn): | CODE |
| MEDIUM | tests/manual/telegram/generate_test_messages.py | 94 | print(f"Error: Unknown type '{test_type}'") | CODE |
| MEDIUM | …de/skills/skill-creator/eval-viewer/generate_review.py | 408 | print(f"Error: {workspace} is not a directory", file=sys.stderr) | CODE |
| LOW | .claude/skills/skill-creator/scripts/run_eval.py | 223 | except Exception as e: | CODE |
| MEDIUM | .claude/skills/skill-creator/scripts/run_eval.py | 276 | print(f"Error: No SKILL.md found at {skill_path}", file=sys.stderr) | CODE |
| LOW | .claude/skills/skill-creator/scripts/package_skill.py | 106 | except Exception as e: | CODE |
| MEDIUM | …de/skills/skill-creator/scripts/improve_description.py | 205 | print(f"Error: No SKILL.md found at {skill_path}", file=sys.stderr) | CODE |
| MEDIUM | .claude/skills/skill-creator/scripts/run_loop.py | 265 | print(f"Error: No SKILL.md found at {skill_path}", file=sys.stderr) | CODE |
| LOW | scripts/ci/comment_hygiene_gate.py | 648 | except Exception as exc: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …de/skills/skill-creator/eval-viewer/generate_review.py | 85 | CODE | |
| LOW | …de/skills/skill-creator/eval-viewer/generate_review.py | 149 | CODE | |
| LOW | …de/skills/skill-creator/eval-viewer/generate_review.py | 288 | CODE | |
| LOW | .claude/skills/skill-creator/scripts/run_eval.py | 35 | CODE | |
| LOW | .claude/skills/skill-creator/scripts/package_skill.py | 42 | CODE | |
| LOW | …de/skills/skill-creator/scripts/improve_description.py | 50 | CODE | |
| LOW | …de/skills/skill-creator/scripts/aggregate_benchmark.py | 67 | CODE | |
| LOW | .claude/skills/skill-creator/scripts/generate_report.py | 16 | CODE | |
| LOW | .claude/skills/skill-creator/scripts/utils.py | 7 | CODE | |
| LOW | scripts/migrate-skill-toml.py | 80 | CODE | |
| LOW | scripts/migrate-skill-toml.py | 250 | CODE | |
| LOW | scripts/ci/collect_changed_links.py | 243 | CODE | |
| LOW | scripts/ci/comment_hygiene_gate.py | 43 | CODE | |
| LOW | scripts/ci/comment_hygiene_gate.py | 173 | CODE | |
| LOW | scripts/ci/comment_hygiene_gate.py | 225 | CODE | |
| LOW | scripts/ci/comment_hygiene_gate.py | 287 | CODE | |
| LOW | scripts/ci/comment_hygiene_gate.py | 388 | CODE | |
| LOW | scripts/ci/comment_hygiene_gate.py | 603 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/deploy-rpi.sh | 14 | # Usage: | COMMENT |
| LOW | scripts/desktop/prepare-kernel.sh | 14 | # Usage: | COMMENT |
| LOW | scripts/release/bump-version.sh | 6 | # Usage: | COMMENT |
| LOW | scripts/release/refresh-translations.sh | 9 | # Usage: | COMMENT |
| LOW | scripts/dev/act-local.sh | 33 | # Usage: | COMMENT |
| LOW | scripts/dev/refresh-nix-hashes.sh | 9 | # Usage: | COMMENT |
| LOW | dev/test-termux-release.sh | 5 | # Usage: | COMMENT |
| LOW | dev/test-quickstart.sh | 4 | # Usage: | COMMENT |
| LOW⚡ | dev/test-harness.sh | 12 | # Usage: | COMMENT |
| LOW | dev/docker-compose.yml | 8 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | crates/zeroclaw-tools/src/web_search_tool.rs | 1024 | // long markdown / AI-generated summaries per hit, so a single search can crowd | COMMENT |
| HIGH | docs/book/src/getting-started/quickstart.md | 63 | or a token generated by Claude Max: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | install.sh | 493 | # Check if another zeroclaw still lurks in PATH | COMMENT |
| LOW | tests/manual/test_dockerignore.sh | 136 | # Check if .git would be excluded | COMMENT |
| LOW | tests/manual/test_dockerignore.sh | 145 | # Check if any .db files exist and would be excluded | COMMENT |
| LOW | scripts/browser/start-browser.sh | 12 | # Check if display is running | COMMENT |
| LOW | .github/workflows/tweet-release.yml | 183 | # Check if we already have a cache hit for this exact tweet | COMMENT |
| LOW | dev/test-termux-release.sh | 167 | # Check if it's glibc or bionic | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .claude/skills/skill-creator/scripts/quick_validate.py | 7 | CODE | |
| LOW | scripts/migrate-skill-toml.py | 15 | CODE | |
| LOW | scripts/ci/collect_changed_links.py | 3 | CODE | |
| LOW | scripts/ci/comment_hygiene_gate.py | 5 | CODE | |
| LOW | scripts/ci/list_git_dep_keys.py | 7 | CODE | |
| LOW | scripts/ci/release_attestation_contract_test.py | 4 | CODE | |
| LOW | scripts/github/project_dashboard_plan.py | 9 | CODE | |
| LOW | scripts/github/project_dashboard_plan_test.py | 4 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | firmware/pico/src/main.rs | 77 | // TODO: implement dynamic GPIO pin drivers | COMMENT |
| LOW | firmware/esp32/src/main.rs | 104 | // TODO: implement input pin read — requires storing InputPin drivers per pin | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | benches/agent_benchmarks.rs | 165 | Let me know if you need more."# | CODE |