{
  "schemaVersion": 1,
  "slug": "conversion-desk",
  "repository": "webhostingdoo/conversion-desk",
  "sourceSha": "aa2e5ea92c3ee3238797b3fd32367eeafae925f7",
  "hqSha": "b4553ab14f4cde1f764f87925a9585e2515b6ac3",
  "scannedAt": "2026-10-23T13:14:30.997Z",
  "status": "scanned",
  "findings": [
    {
      "id": "e228954257c414d2",
      "category": "access",
      "label": "OAuth flow",
      "detail": "OAuth reference; provider, consent scopes, token custody and access checks need confirmation.",
      "confidence": "inferred",
      "evidence": [
        {
          "path": "docs/OPERATIONS.md",
          "line": 58,
          "kind": "source-reported"
        },
        {
          "path": "hub/drive.py",
          "line": 385,
          "kind": "observed-code"
        },
        {
          "path": "hub/google_connection.py",
          "line": 4,
          "kind": "observed-code"
        },
        {
          "path": "hub/live.py",
          "line": 58,
          "kind": "observed-code"
        },
        {
          "path": "hub/retractions.py",
          "line": 67,
          "kind": "observed-code"
        },
        {
          "path": "scripts/google_signin.py",
          "line": 1,
          "kind": "observed-code"
        },
        {
          "path": "tests/test_google_signin.py",
          "line": 16,
          "kind": "observed-code"
        },
        {
          "path": "tests/test_live_hosted.py",
          "line": 299,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "df8638047fc1f196",
      "category": "apis",
      "label": "DELETE /api/uploads/{ticket}",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 502,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "0be9fd04ff4704da",
      "category": "apis",
      "label": "GET /",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 148,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "35c1316dc3aea019",
      "category": "apis",
      "label": "GET /api/accounts",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 191,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "8471b0df8088b8b2",
      "category": "apis",
      "label": "GET /api/accounts/{account}/csv-publications",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 341,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "c5771da8bf200d17",
      "category": "apis",
      "label": "GET /api/accounts/{account}/csv-workflows",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 337,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "6c5b19530cc21534",
      "category": "apis",
      "label": "GET /api/accounts/{account}/profile",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 216,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "d06c28f2d782dca5",
      "category": "apis",
      "label": "GET /api/audit",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 320,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "e08e4b6d3463b4e4",
      "category": "apis",
      "label": "GET /api/batches",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 231,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "eac9ff32b79011c5",
      "category": "apis",
      "label": "GET /api/batches/{batch_id}",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 236,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "c4111a1b6a3e2964",
      "category": "apis",
      "label": "GET /api/batches/{batch_id}/csv",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 258,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "89b2355c9b9239c1",
      "category": "apis",
      "label": "GET /api/batches/{batch_id}/csv-adjustments",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 329,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "67ba3e7e41737541",
      "category": "apis",
      "label": "GET /api/batches/{batch_id}/hybrid",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 418,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "2cddbfde24114ba5",
      "category": "apis",
      "label": "GET /api/batches/{batch_id}/rows/{order_id}/source-review",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 246,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "58b50007ebc2db57",
      "category": "apis",
      "label": "GET /api/csv-workflows/{workflow_id}/file",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 349,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "a6673cd59899fc85",
      "category": "apis",
      "label": "GET /api/csv-workflows/{workflow_id}/worksheet",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 354,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "3dd2d9145b616dd9",
      "category": "apis",
      "label": "GET /api/deliveries",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 303,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "b679a1dae81fefe4",
      "category": "apis",
      "label": "GET /api/health",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 150,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "89c0eb4220987f2a",
      "category": "apis",
      "label": "GET /api/session",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 182,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "de31842e69e76bb6",
      "category": "apis",
      "label": "GET /api/upload-health",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 316,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "ab7604e5cd17a47c",
      "category": "apis",
      "label": "Google Ads",
      "detail": "Mentioned in source documentation; implementation and account access need confirmation.",
      "confidence": "inferred",
      "evidence": [
        {
          "path": "docs/OPERATIONS.md",
          "line": 72,
          "kind": "source-reported"
        }
      ]
    },
    {
      "id": "3506084ed11133e3",
      "category": "apis",
      "label": "Google APIs",
      "detail": "Integration signal in source. Account ownership, provisioning and live connectivity are unverified.",
      "confidence": "inferred",
      "evidence": [
        {
          "path": "requirements-google.txt",
          "line": 3,
          "kind": "declared-config"
        },
        {
          "path": "requirements.txt",
          "line": 8,
          "kind": "declared-config"
        }
      ]
    },
    {
      "id": "25a9856f4556aaf0",
      "category": "apis",
      "label": "Invoca",
      "detail": "Mentioned in source documentation; implementation and account access need confirmation.",
      "confidence": "inferred",
      "evidence": [
        {
          "path": "docs/OPERATIONS.md",
          "line": 9,
          "kind": "source-reported"
        },
        {
          "path": "README.md",
          "line": 3,
          "kind": "source-reported"
        },
        {
          "path": "hub/pilot.py",
          "line": 126,
          "kind": "observed-code"
        },
        {
          "path": "hub/static/app.js",
          "line": 327,
          "kind": "observed-code"
        },
        {
          "path": "hub/static/hybrid.js",
          "line": 92,
          "kind": "observed-code"
        },
        {
          "path": "tests/hybrid_intake_ui.cjs",
          "line": 6,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "14c3237bf8f0630a",
      "category": "apis",
      "label": "PATCH /api/accounts/{account}/settings",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 301,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "fdc75663286eaf46",
      "category": "apis",
      "label": "POST /api/accounts",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 213,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "71bce8892b4f872d",
      "category": "apis",
      "label": "POST /api/accounts/{account}/delivery-mode",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 378,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "5a133cab17a7c2a3",
      "category": "apis",
      "label": "POST /api/accounts/{account}/drive/publications/{publication_id}/check",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 398,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "23d13cf365f90cac",
      "category": "apis",
      "label": "POST /api/accounts/{account}/drive/publications/{publication_id}/results",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 345,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "487c64d5e609d98b",
      "category": "apis",
      "label": "POST /api/accounts/{account}/drive/target/apply",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 386,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "71d139c876919ec1",
      "category": "apis",
      "label": "POST /api/accounts/{account}/drive/target/preview",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 382,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "ee944d1860a8a0e8",
      "category": "apis",
      "label": "POST /api/accounts/{account}/example",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 289,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "fb458943869944cf",
      "category": "apis",
      "label": "POST /api/accounts/{account}/google/actions/apply",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 453,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "b14e2dd091080c4c",
      "category": "apis",
      "label": "POST /api/accounts/{account}/google/actions/discover",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 445,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "1c0a66576befd4cf",
      "category": "apis",
      "label": "POST /api/accounts/{account}/google/actions/preview",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 449,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "e20985f4ee548521",
      "category": "apis",
      "label": "POST /api/accounts/{account}/google/actions/reconcile",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 457,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "edf530e6bd059975",
      "category": "apis",
      "label": "POST /api/accounts/{account}/google/activate",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 432,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "ea40c27990b5cc5d",
      "category": "apis",
      "label": "POST /api/accounts/{account}/google/check",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 409,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "4a6fc6800a929070",
      "category": "apis",
      "label": "POST /api/accounts/{account}/google/deactivate",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 436,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "5fb3f1fa5e4ffb1b",
      "category": "apis",
      "label": "POST /api/accounts/{account}/hybrid/advance",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 427,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "3be6ed9dd0af50df",
      "category": "apis",
      "label": "POST /api/accounts/{account}/hybrid/configure",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 413,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "2c3f9e0945bf0db9",
      "category": "apis",
      "label": "POST /api/accounts/{account}/profile/apply",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 226,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "f923ea7f5c4f7f99",
      "category": "apis",
      "label": "POST /api/accounts/{account}/profile/preview",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 221,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "fa81f220154f6565",
      "category": "apis",
      "label": "POST /api/accounts/preview",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 209,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "541051873358c78f",
      "category": "apis",
      "label": "POST /api/batches/{batch_id}/approve",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 271,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "3ba4a0e4f651bca8",
      "category": "apis",
      "label": "POST /api/batches/{batch_id}/cancel",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 238,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "39594503becacc92",
      "category": "apis",
      "label": "POST /api/batches/{batch_id}/csv-adjustments",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 333,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "dcd460130623b2fa",
      "category": "apis",
      "label": "POST /api/batches/{batch_id}/drive/prepare",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 390,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "4fb9423a796f556c",
      "category": "apis",
      "label": "POST /api/batches/{batch_id}/drive/publish",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 394,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "85083d8980739cb6",
      "category": "apis",
      "label": "POST /api/batches/{batch_id}/hybrid/approve",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 422,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "b462ff3b83914808",
      "category": "apis",
      "label": "POST /api/batches/{batch_id}/live/approve",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 465,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "c51d47d888f77b31",
      "category": "apis",
      "label": "POST /api/batches/{batch_id}/live/prepare",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 461,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "855f87159d59b38d",
      "category": "apis",
      "label": "POST /api/batches/{batch_id}/recover-identifiers",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 240,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "213023f851cef8cb",
      "category": "apis",
      "label": "POST /api/batches/{batch_id}/recover-salesforce-urls",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 241,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "ce249a439e707319",
      "category": "apis",
      "label": "POST /api/batches/{batch_id}/rows/{order_id}/source-review/apply",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 254,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "87f27488052aa97b",
      "category": "apis",
      "label": "POST /api/batches/{batch_id}/rows/{order_id}/source-review/preview",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 250,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "a0ae2899c26e686d",
      "category": "apis",
      "label": "POST /api/csv-workflows/{workflow_id}/cancel",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 368,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "aa141382cd56542b",
      "category": "apis",
      "label": "POST /api/csv-workflows/{workflow_id}/results",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 359,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "dc3a110afd17cea3",
      "category": "apis",
      "label": "POST /api/delivery/advance",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 469,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "3c2fee1954f967a8",
      "category": "apis",
      "label": "POST /api/login",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 152,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "159c28aeb6595ba9",
      "category": "apis",
      "label": "POST /api/logout",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 184,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "fcf6ff5ebde05b90",
      "category": "apis",
      "label": "POST /api/simulation/advance",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 479,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "65d972f1f1dde3d9",
      "category": "apis",
      "label": "POST /api/upload",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 279,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "7e3fe6889ed6de0c",
      "category": "apis",
      "label": "POST /api/upload-health/check",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 473,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "be81a32fcefab7d6",
      "category": "apis",
      "label": "POST /api/uploads",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 483,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "9fa786ead6c43ac7",
      "category": "apis",
      "label": "POST /api/uploads/{ticket}/finish",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 498,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "7a16bc372b72696d",
      "category": "apis",
      "label": "PUT /api/uploads/{ticket}/{source}/{part}",
      "detail": "Source-declared endpoint. Authentication, deployment and side effects require review.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 489,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "c516fc29b2b79257",
      "category": "configuration",
      "label": "CD_POSTGRES_CONFIG",
      "detail": "Configuration name referenced; actual value, required/optional status and provisioning are unverified.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "tests/test_postgres_integration.py",
          "line": 334,
          "kind": "observed-code"
        },
        {
          "path": "tests/test_postgres_integration.py",
          "line": 25,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "59ebcb35814ef5e1",
      "category": "configuration",
      "label": "DATABASE_URL",
      "detail": "Configuration name referenced; actual value, required/optional status and provisioning are unverified.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/hosted.py",
          "line": 28,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "04d014edba037bff",
      "category": "configuration",
      "label": "GOOGLE_APPLICATION_CREDENTIALS",
      "detail": "Secret-like name referenced; actual value, required/optional status and provisioning are unverified.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "tests/test_google_signin.py",
          "line": 126,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "ee612845cf07b331",
      "category": "configuration",
      "label": "HUB_ALLOWED_HOSTS",
      "detail": "Declared in an environment template. Value discarded; provisioning and required/optional status are unverified.",
      "confidence": "direct",
      "evidence": [
        {
          "path": ".env.example",
          "line": 6,
          "kind": "declared-config"
        },
        {
          "path": "hub/app.py",
          "line": 98,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "5b8e7dfa2741ff43",
      "category": "configuration",
      "label": "HUB_BROWSER_EXECUTABLE",
      "detail": "Configuration name referenced; actual value, required/optional status and provisioning are unverified.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "tests/test_cd002_regressions.py",
          "line": 153,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "33eb87fd4fc0c601",
      "category": "configuration",
      "label": "HUB_COOKIE_SECURE",
      "detail": "Declared in an environment template. Value discarded; provisioning and required/optional status are unverified.",
      "confidence": "direct",
      "evidence": [
        {
          "path": ".env.example",
          "line": 5,
          "kind": "declared-config"
        },
        {
          "path": "hub/app.py",
          "line": 105,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "17d0a00e80bfb57f",
      "category": "configuration",
      "label": "HUB_DATA_KEY",
      "detail": "Configuration name referenced; actual value, required/optional status and provisioning are unverified.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 55,
          "kind": "observed-code"
        },
        {
          "path": "hub/hosted.py",
          "line": 28,
          "kind": "observed-code"
        },
        {
          "path": "hub/preflight.py",
          "line": 49,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "635441c1d86caf0d",
      "category": "configuration",
      "label": "HUB_ENABLE_GOOGLE_RETRACTIONS",
      "detail": "Configuration name referenced; actual value, required/optional status and provisioning are unverified.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/retractions.py",
          "line": 61,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "eb9f76a4db55287e",
      "category": "configuration",
      "label": "HUB_ENABLE_LIVE_GOOGLE",
      "detail": "Declared in an environment template. Value discarded; provisioning and required/optional status are unverified.",
      "confidence": "direct",
      "evidence": [
        {
          "path": ".env.example",
          "line": 4,
          "kind": "declared-config"
        },
        {
          "path": "hub/hosted.py",
          "line": 7,
          "kind": "observed-code"
        },
        {
          "path": "run.py",
          "line": 14,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "1934e756f2125f08",
      "category": "configuration",
      "label": "HUB_GOOGLE_ADS_CREDENTIALS",
      "detail": "Secret-like name referenced; actual value, required/optional status and provisioning are unverified.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/retractions.py",
          "line": 60,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "1f4476bc71f59ca9",
      "category": "configuration",
      "label": "HUB_GOOGLE_DELIVERY_HOST",
      "detail": "Configuration name referenced; actual value, required/optional status and provisioning are unverified.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 68,
          "kind": "observed-code"
        },
        {
          "path": "hub/hosted.py",
          "line": 17,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "ac0bf14cafc9f4bc",
      "category": "configuration",
      "label": "HUB_GOOGLE_DRIVE_AUTH",
      "detail": "Configuration name referenced; actual value, required/optional status and provisioning are unverified.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/hosted.py",
          "line": 11,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "1152c17c83734abf",
      "category": "configuration",
      "label": "HUB_PASSWORD",
      "detail": "Declared in an environment template. Value discarded; provisioning and required/optional status are unverified.",
      "confidence": "direct",
      "evidence": [
        {
          "path": ".env.example",
          "line": 2,
          "kind": "declared-config"
        },
        {
          "path": "hub/app.py",
          "line": 48,
          "kind": "observed-code"
        },
        {
          "path": "run.py",
          "line": 10,
          "kind": "observed-code"
        },
        {
          "path": "run.py",
          "line": 8,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "5231ddaf02b3a10e",
      "category": "configuration",
      "label": "HUB_PORT",
      "detail": "Declared in an environment template. Value discarded; provisioning and required/optional status are unverified.",
      "confidence": "direct",
      "evidence": [
        {
          "path": ".env.example",
          "line": 17,
          "kind": "declared-config"
        },
        {
          "path": "run.py",
          "line": 15,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "c5c5225c4172f8b5",
      "category": "configuration",
      "label": "HUB_STATE_DIR",
      "detail": "Declared in an environment template. Value discarded; provisioning and required/optional status are unverified.",
      "confidence": "direct",
      "evidence": [
        {
          "path": ".env.example",
          "line": 3,
          "kind": "declared-config"
        },
        {
          "path": "hub/app.py",
          "line": 55,
          "kind": "observed-code"
        },
        {
          "path": "hub/preflight.py",
          "line": 41,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "6bf556f9ab03c2dd",
      "category": "configuration",
      "label": "VERCEL",
      "detail": "Configuration name referenced; actual value, required/optional status and provisioning are unverified.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 155,
          "kind": "observed-code"
        },
        {
          "path": "hub/hosted.py",
          "line": 11,
          "kind": "observed-code"
        },
        {
          "path": "hub/hosted.py",
          "line": 15,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "1ee22e0dcc4282c8",
      "category": "configuration",
      "label": "VERCEL_ENV",
      "detail": "Configuration name referenced; actual value, required/optional status and provisioning are unverified.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/hosted.py",
          "line": 11,
          "kind": "observed-code"
        },
        {
          "path": "hub/hosted.py",
          "line": 15,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "da4676811e361d2c",
      "category": "data",
      "label": "PostgreSQL",
      "detail": "Integration signal in source. Account ownership, provisioning and live connectivity are unverified.",
      "confidence": "inferred",
      "evidence": [
        {
          "path": "requirements.txt",
          "line": 7,
          "kind": "declared-config"
        },
        {
          "path": "hub/postgres_store.py",
          "line": 111,
          "kind": "observed-code"
        },
        {
          "path": "tests/test_postgres_integration.py",
          "line": 340,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "3dfca7964a7c8dd4",
      "category": "data",
      "label": "SQLite",
      "detail": "Integration signal in source. Account ownership, provisioning and live connectivity are unverified.",
      "confidence": "inferred",
      "evidence": [
        {
          "path": "hub/pilot.py",
          "line": 14,
          "kind": "observed-code"
        },
        {
          "path": "hub/store.py",
          "line": 9,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "b173cf342c21c119",
      "category": "devices",
      "label": "Browser automation",
      "detail": "Browser automation signal; browser binaries, host and permissions may be required.",
      "confidence": "inferred",
      "evidence": [
        {
          "path": "requirements-dev.txt",
          "line": 4,
          "kind": "declared-config"
        },
        {
          "path": "tests/test_cd002_regressions.py",
          "line": 152,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "1e0a3ffe38003b16",
      "category": "devices",
      "label": "Local filesystem access",
      "detail": "Filesystem reference; approved paths, read/write scope and operating identity need confirmation.",
      "confidence": "inferred",
      "evidence": [
        {
          "path": "hub/app.py",
          "line": 12,
          "kind": "observed-code"
        },
        {
          "path": "hub/hosted_state.py",
          "line": 7,
          "kind": "observed-code"
        },
        {
          "path": "hub/pilot.py",
          "line": 17,
          "kind": "observed-code"
        },
        {
          "path": "hub/preflight.py",
          "line": 10,
          "kind": "observed-code"
        },
        {
          "path": "hub/retractions.py",
          "line": 11,
          "kind": "observed-code"
        },
        {
          "path": "hub/store.py",
          "line": 12,
          "kind": "observed-code"
        },
        {
          "path": "scripts/build_preview.py",
          "line": 2,
          "kind": "observed-code"
        },
        {
          "path": "scripts/check_repository_boundary.py",
          "line": 10,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "57e8060de5ad3e87",
      "category": "devices",
      "label": "Local process access",
      "detail": "Source starts or inspects local processes. Commands, execution owner and machine access need review.",
      "confidence": "inferred",
      "evidence": [
        {
          "path": "scripts/check_repository_boundary.py",
          "line": 57,
          "kind": "observed-code"
        },
        {
          "path": "scripts/release_live_connection.py",
          "line": 65,
          "kind": "observed-code"
        },
        {
          "path": "scripts/verify_postgres_private.py",
          "line": 30,
          "kind": "observed-code"
        },
        {
          "path": "tests/test_batch_cancellation.py",
          "line": 186,
          "kind": "observed-code"
        },
        {
          "path": "tests/test_cd002_regressions.py",
          "line": 142,
          "kind": "observed-code"
        },
        {
          "path": "tests/test_gbraid.py",
          "line": 302,
          "kind": "observed-code"
        },
        {
          "path": "tests/test_hybrid.py",
          "line": 31,
          "kind": "observed-code"
        },
        {
          "path": "tests/test_invoca_gbraid.py",
          "line": 224,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "dcf7e759e8e5f4c6",
      "category": "hosting",
      "label": "Vercel configuration",
      "detail": "Deployment configuration is present. The live project, environment and deployed revision are not queried.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "vercel.json",
          "line": 1,
          "kind": "declared-config"
        }
      ]
    },
    {
      "id": "5cf92b354d05cb63",
      "category": "observability",
      "label": "Application error logging",
      "detail": "Error logging call exists; destination, alerting, retention and redaction are unverified.",
      "confidence": "inferred",
      "evidence": [
        {
          "path": "tests/batch_cancellation_ui.cjs",
          "line": 63,
          "kind": "observed-code"
        },
        {
          "path": "tests/gbraid_ui.cjs",
          "line": 28,
          "kind": "observed-code"
        },
        {
          "path": "tests/hybrid_intake_ui.cjs",
          "line": 38,
          "kind": "observed-code"
        },
        {
          "path": "tests/review_race.cjs",
          "line": 127,
          "kind": "observed-code"
        },
        {
          "path": "tests/source_coverage_ui.cjs",
          "line": 34,
          "kind": "observed-code"
        },
        {
          "path": "tests/upload_health_ui.cjs",
          "line": 62,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "f9f07960402880c7",
      "category": "providers",
      "label": "Google Ads",
      "detail": "Mentioned in source documentation; implementation and account access need confirmation.",
      "confidence": "inferred",
      "evidence": [
        {
          "path": "docs/OPERATIONS.md",
          "line": 72,
          "kind": "source-reported"
        }
      ]
    },
    {
      "id": "fc27bef842ea609c",
      "category": "providers",
      "label": "Google APIs",
      "detail": "Integration signal in source. Account ownership, provisioning and live connectivity are unverified.",
      "confidence": "inferred",
      "evidence": [
        {
          "path": "requirements-google.txt",
          "line": 3,
          "kind": "declared-config"
        },
        {
          "path": "requirements.txt",
          "line": 8,
          "kind": "declared-config"
        }
      ]
    },
    {
      "id": "a353f77a14938865",
      "category": "providers",
      "label": "Invoca",
      "detail": "Mentioned in source documentation; implementation and account access need confirmation.",
      "confidence": "inferred",
      "evidence": [
        {
          "path": "docs/OPERATIONS.md",
          "line": 9,
          "kind": "source-reported"
        },
        {
          "path": "README.md",
          "line": 3,
          "kind": "source-reported"
        },
        {
          "path": "hub/pilot.py",
          "line": 126,
          "kind": "observed-code"
        },
        {
          "path": "hub/static/app.js",
          "line": 327,
          "kind": "observed-code"
        },
        {
          "path": "hub/static/hybrid.js",
          "line": 92,
          "kind": "observed-code"
        },
        {
          "path": "tests/hybrid_intake_ui.cjs",
          "line": 6,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "f6894bcdcb6e86c5",
      "category": "quality",
      "label": "Test sources present",
      "detail": "Test paths found in the tree; their contents and outcomes are not inferred from existence.",
      "confidence": "inferred",
      "evidence": [
        {
          "path": "tests/batch_cancellation_ui.cjs",
          "line": 1,
          "kind": "declared-config"
        },
        {
          "path": "tests/gbraid_ui.cjs",
          "line": 1,
          "kind": "declared-config"
        },
        {
          "path": "tests/hybrid_intake_ui.cjs",
          "line": 1,
          "kind": "declared-config"
        },
        {
          "path": "tests/review_race.cjs",
          "line": 1,
          "kind": "declared-config"
        },
        {
          "path": "tests/source_coverage_ui.cjs",
          "line": 1,
          "kind": "declared-config"
        },
        {
          "path": "tests/test_accounts.py",
          "line": 1,
          "kind": "declared-config"
        },
        {
          "path": "tests/test_app.py",
          "line": 1,
          "kind": "declared-config"
        },
        {
          "path": "tests/test_attribution_review.py",
          "line": 1,
          "kind": "declared-config"
        }
      ]
    },
    {
      "id": "e88a513558e36d3f",
      "category": "runtime",
      "label": "Browser document",
      "detail": "HTML source is present. Browser compatibility, hosting and live data access are unverified.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "hub/static/index.html",
          "line": 1,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "23e2c82445083b0c",
      "category": "runtime",
      "label": "cryptography",
      "detail": "Python dependency declaration. Installed version and runtime availability are unverified.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "requirements.txt",
          "line": 4,
          "kind": "declared-config"
        }
      ]
    },
    {
      "id": "485f6033cfd27614",
      "category": "runtime",
      "label": "fastapi",
      "detail": "Python dependency declaration. Installed version and runtime availability are unverified.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "requirements.txt",
          "line": 1,
          "kind": "declared-config"
        }
      ]
    },
    {
      "id": "bdd96d0f19b32e03",
      "category": "runtime",
      "label": "google-auth",
      "detail": "Python dependency declaration. Installed version and runtime availability are unverified.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "requirements.txt",
          "line": 8,
          "kind": "declared-config"
        }
      ]
    },
    {
      "id": "ac6a8aa102ab755c",
      "category": "runtime",
      "label": "httpx",
      "detail": "Python dependency declaration. Installed version and runtime availability are unverified.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "requirements.txt",
          "line": 5,
          "kind": "declared-config"
        }
      ]
    },
    {
      "id": "5cc119b24ca15681",
      "category": "runtime",
      "label": "playwright",
      "detail": "Python dependency declaration. Installed version and runtime availability are unverified.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "requirements-dev.txt",
          "line": 4,
          "kind": "declared-config"
        }
      ]
    },
    {
      "id": "c816f9ce01ae5b15",
      "category": "runtime",
      "label": "psycopg",
      "detail": "Python dependency declaration. Installed version and runtime availability are unverified.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "requirements.txt",
          "line": 7,
          "kind": "declared-config"
        }
      ]
    },
    {
      "id": "26e64cf3d6e15eba",
      "category": "runtime",
      "label": "pytest",
      "detail": "Python dependency declaration. Installed version and runtime availability are unverified.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "requirements-dev.txt",
          "line": 2,
          "kind": "declared-config"
        }
      ]
    },
    {
      "id": "70505e863517d4f4",
      "category": "runtime",
      "label": "Python source",
      "detail": "Python source is present. The required interpreter, installed packages and launch environment need confirmation.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "app.py",
          "line": 1,
          "kind": "observed-code"
        },
        {
          "path": "hub/__init__.py",
          "line": 1,
          "kind": "observed-code"
        },
        {
          "path": "hub/accounts.py",
          "line": 1,
          "kind": "observed-code"
        },
        {
          "path": "hub/adjustments.py",
          "line": 1,
          "kind": "observed-code"
        },
        {
          "path": "hub/app.py",
          "line": 1,
          "kind": "observed-code"
        },
        {
          "path": "hub/attribution_review.py",
          "line": 1,
          "kind": "observed-code"
        },
        {
          "path": "hub/csv_adjustments.py",
          "line": 1,
          "kind": "observed-code"
        },
        {
          "path": "hub/delivery.py",
          "line": 1,
          "kind": "observed-code"
        }
      ]
    },
    {
      "id": "1f8e4d5fc4825834",
      "category": "runtime",
      "label": "python-multipart",
      "detail": "Python dependency declaration. Installed version and runtime availability are unverified.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "requirements.txt",
          "line": 3,
          "kind": "declared-config"
        }
      ]
    },
    {
      "id": "b46795753cf3fa6c",
      "category": "runtime",
      "label": "tzdata",
      "detail": "Python dependency declaration. Installed version and runtime availability are unverified.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "requirements.txt",
          "line": 6,
          "kind": "declared-config"
        }
      ]
    },
    {
      "id": "c14f8af436a230ed",
      "category": "runtime",
      "label": "uvicorn",
      "detail": "Python dependency declaration. Installed version and runtime availability are unverified.",
      "confidence": "direct",
      "evidence": [
        {
          "path": "requirements.txt",
          "line": 2,
          "kind": "declared-config"
        }
      ]
    },
    {
      "id": "afc6f3a6678bc0b1",
      "category": "schedules",
      "label": "In-process timer",
      "detail": "Timer reference; this does not establish a durable or currently running job.",
      "confidence": "inferred",
      "evidence": [
        {
          "path": "hub/static/app.js",
          "line": 330,
          "kind": "observed-code"
        },
        {
          "path": "tests/batch_cancellation_ui.cjs",
          "line": 10,
          "kind": "observed-code"
        },
        {
          "path": "tests/gbraid_ui.cjs",
          "line": 5,
          "kind": "observed-code"
        },
        {
          "path": "tests/source_coverage_ui.cjs",
          "line": 7,
          "kind": "observed-code"
        }
      ]
    }
  ],
  "coverage": {
    "listed": 104,
    "eligible": 93,
    "inspected": 93,
    "skipped": 11,
    "failed": 0,
    "bytes": 934241,
    "treeTruncated": false,
    "limited": false
  },
  "gaps": [
    "Static inspection does not verify runtime health, current use, provisioning, live schedules, service account access or deployed/source alignment.",
    "Only bounded source/configuration files are inspected. Secret files, data exports, binaries, history and raw source text are excluded from results.",
    "Unknown or dynamically constructed integrations and configuration names may not be detected. Human review is still needed."
  ],
  "changes": {
    "previousSha": "aa2e5ea92c3ee3238797b3fd32367eeafae925f7",
    "added": 2,
    "removed": 0
  }
}