# Review of the deeper scan

Codex reviewed the generated structured evidence and comparisons on 2026-10-23. This is an assessment of the scan results; individual cards remain machine-drafted and the owner's operating decisions remain unset.

[Run index](index.md) · [Artifact verification](verification.json) · [Cross-app candidates](cross-app-references.json)

The stronger parts of this pass are explicit native script entry points, richer schema and possible-write evidence, operating-document pointers, tracking-reference comparison and versioned receipts. It reuses the current scanner and viewer instead of creating a competing app inventory.

## Findings worth reviewing

- **Two shared tracking-reference groups connect amity-lander and tdd-lander:** one Google Tag Manager reference and one phone destination. Values are withheld; the receipts link exact source locations. This may be intentional shared configuration. Confirm destination ownership before labeling it a copied-donor defect.
- **Thirteen configuration names appear in multiple apps.** Name reuse is useful for organizing a future requirements inventory, but does not establish that the apps use the same key, account or environment. Do not convert these matches into shared-secret ownership.
- **rsa-copy moved to a newer default-branch revision.** Its new findings combine source change and extractor/scope change. Other nonempty repositories matched their earlier source SHA, so their changed findings primarily reflect inspection changes.
- **ppc-lander-intel now has 268 inspected files, up from 180; Sunshine-Performance-Reporting has 144, up from 140.** Their earlier caps no longer leave eligible files unread in this run.
- **The geography repository has a stricter source boundary.** Its 150 inspected files exclude data/ and seed/dump material that could contain records. Complete within this scope does not mean every file or integration was inspected.
- **The richer JavaScript script inventory exposes useful operating entry points.** For example, sqc declares diagnostic, local development, dependency/input audit and local backup script names; Sunshine reporting declares monitoring, privacy, hosted and database checks. Declarations are evidence routes, not instructions to execute them or proof of successful checks.
- **Python/native startup remains incomplete.** Conversion Desk and rsa-copy need targeted interpretation of their source/run documentation. The scan deliberately does not copy arbitrary shell commands or make up a run procedure from filenames.
- **121 operating-document references now have paths, line counts and hashes.** Their prose remains in the source repositories. They are a route to the interpretation layer, not a substitute for reading those documents during a scoped review.

## Limits of the result count

The 3,085 findings include multiple occurrences and candidate method names. A `.delete()`, `.update()` or `.sendMail()` signal must be traced to its receiver and guard before being classified as an external write. Some signals are local collection operations or optional paths. No live service was queried and no donor command was executed.

The per-app cards are draft navigation surfaces. Setup/run/recovery instructions, provider ownership, required secrets, actual schedules, deployed revisions, current use and review verdicts remain unknown where source evidence does not settle them. The receipt separately records source freshness at scan completion. No review field implies runtime acceptance or permission for follow-on work.