sinkOutcomes resolves a deep-dive report into a location-keyed map of what happened to each inventory sink. Per-run S<n> ids are unstable across runs

sortSlice is a tiny wrapper so the handler reads like `sortSlice(rows, less)` without pulling sort.Slice's (i, j int) idiom into each case.

stageThreatModel writes the repository's operator-edited threat model to ./threat_model.json so skills that consume one (security-deep-dive) can load

streamJSONL iterates rows incrementally so a million-row export never preloads into memory. The body is partial on mid-stream errors: once we have com

tabPanelBody returns the substring of body starting at marker through the next closing </div> that matches the panel's opening div. Cheap-and-good- en

validateGitURL rejects anything that isn't https:// to prevent SSRF, local file reads, and git option injection (T2, T4).

BackfillFindingFingerprints fills Finding.Fingerprint for rows created before the column existed, joining through Scan for skill_name. It does not mer

BackfillRepoDiskUsage fills Repository.DiskBytes for remote repos that have no cached value yet, so the disk-usage badge shows immediately on upgrade

Cancel aborts an in-flight scan. Returns true if a running job was found and signalled; false means the scan is queued (or already finished) and the c

ComputeAuditMetrics scans the FindingReview table and returns aggregate stats for the audit page. A review counts toward agreement only when both the

DefaultHTMLURL seeds Repository.HTMLURL at row-create time for the common case where the clone URL is also the web-UI URL — every major public forge.

EgressHosts is the model-API hostnames the harness must reach, in the same wildcard form as DefaultEgressAllow. They are appended to the egress proxy'

EnsureHardenedNetwork creates an internal container network with the given name if it does not already exist. --internal blocks routes to external net

Env returns the harness-specific environment for the container, in docker -e form: a bare "KEY" passes the host value through, and "KEY=VALUE" sets it

ListFindingReviews returns reviews for one finding, newest first. Used by the finding page and the audit queue's reviewed-marker check.

LocalPath returns the filesystem path encoded in a local Repository's URL. Empty for remote repos.

Match reports whether name matches the shell glob pattern. Supports `*` (any chars except `/`), `?` (one char except `/`) and the doublestar `**` (any

NewProxyToken returns 32 hex chars of crypto/rand for Proxy-Authorization.

NormalizeDependencyType reduces git-pkgs and ecosystem-specific dependency phase names to the four buckets scrutineer uses in UI filters and reachabil

ParseScanTimeout validates and parses a scan_timeout string. Empty returns 0 (caller keeps its default); anything else must be a positive time.Duratio

ProxyURLForEndpoint builds the http_proxy-style URL for a proxy reachable at an arbitrary host:port. The egress proxy sidecar is addressed by its cont

QueryRunnerToolVersions starts one short-lived container off the runner image and reads back the versions of the scanner tools it ships. The deployed

RateLimitStatus returns a snapshot of the latest rate-limit status per window, for the usage page. Empty when no subscription rate_limit_event has bee

RepoDiskUsage returns the on-disk size in bytes of the persistent clone cache for repo. Local repositories keep no managed copy (their source stays at

RetireDependentsSkill deactivates the removed bundled dependents skill on upgraded instances. LoadDirectory upserts active skills but does not prune d

ScoreFromV4Vector computes the CVSS v4.0 base score for a vector. Returns (0, false) when the vector is empty or unparseable, matching BaseScoreFromVe

SeedDefaultLabels ensures a baseline set of labels exists on startup. Calling again is idempotent; existing rows are left alone so users can re-colour

SyncCNAs fetches the public CNA partner list and upserts every entry into the cnas table keyed on short_name. Safe to re-run; existing rows are update

ValidateGlob returns path.ErrBadPattern when pattern contains a segment that path.Match cannot parse (e.g. `[unclosed`). matchSegments silently treats

VerifyProxyBinary smoke-tests that the runner image carries the scrutineer binary the egress proxy sidecar runs (`scrutineer proxy`). A runner image w

WaitHostAPIReachable blocks until an HTTP request to host:port returns any response, or ctx is done (fail closed). The egress-proxy sidecar calls it b

accountErrorAccessRevoked reports whether s mentions account access being disabled or revoked -- a permanent problem that must never drive an automati

accountErrorResumable returns false for access/admin errors even when the message also mentions a limit.

buildFixValidationReport assembles the report struct from the already-loaded inputs. Kept pure (no DB access) so the composition and ordering are test

buildLoggedPrompt is what scrutineer records on scan.Prompt for the UI. It pairs the activation invocation with the rendered SKILL.md so the Prompt ta

buildRateLimitPanel formats the worker's latest per-window stream status.

cacheMutex returns the per-URL mutex used to serialise fetch+copy on the dependent cache. Lazily created on first use.

classifyFixValidation splits the baseline scan's findings into the ones the fix-ref re-scan no longer reports (resolved) and the ones it still reports

dedupTestSetup creates a repo and an active finding-dedup skill, and returns helpers for creating scans and findings the callback tests act on.

diffDeepDive compares two deep-dive reports and buckets sinks by how their outcome changed. prev is the older run, curr the newer.

ecosystemsTestServer serves canned responses for every ecosyste.ms source, routed by path, plus the per-package dependent lists chained off /packages

encryptBundle wraps plaintext in armored age for the given recipients. Confidentiality + integrity only, not sender authentication: a recipient can v

enqueueSkillScoped is a thin shim preserved for call sites that already pass a finding id. New code should prefer enqueueSkillWith + ScanOpts.

expandHome expands a leading "~" or "~/" in path to the current user's home directory. Go's os.Open/os.ReadFile don't perform tilde expansion (only th

fetchGitHubOrgRepos lists every repository owned by a GitHub org, paging to completion. It falls back to the /users endpoint when the login is a user

findingFieldAccessor maps the API-facing field name to the current value and the DB column name. It is the single list of mutable fields; adding a new

findingRepoID reads the denormalized Finding.RepositoryID column. Used by the skill-facing handlers to enforce "scan can only touch findings on its ow

firstIfaceIPv4 picks the IPv4 of the first up, non-loopback interface. It fails when that interface has no IPv4 rather than falling through to a later

genEncryptedSSHKey returns a passphrase-protected OpenSSH ed25519 private key PEM.

groupByFingerprint computes each finding's fingerprint and collapses entries that share one into a single finding whose Locations column carries every

hardenedNetworkName returns the network name dedicated to a single hardened scan. Uniqueness per scan is the whole isolation property: two scans must

hardenedProxyReachArgs builds the `run` args for probe (b): a container on the per-scan --internal network that must reach the host egress proxy. curl

hasOpenScan reports whether a queued or running scan matching the given scope predicate already exists. Shared by the finding-scoped and repo-scoped o

isDowngradableTier reports whether a model preference is one of the expensive tiers (max/high) or the empty default (which resolves to high), which th

loadRecipients parses a flat text file of public keys (one per line, '#' comments). Both age X25519 and SSH public keys are accepted. A configured fil

mergeLocations folds extra file:line entries into a newline-joined set, dropping blanks and duplicates while preserving first-seen order so the primar

mkScanDirs creates the on-disk per-scan workspace and claude session store for id under dataDir, mirroring what a real scan leaves behind.

navKey maps a request path to the sidebar item that should be marked aria-current. Paths not in the table fall through to the repositories index, whic

needsEgressSidecar reports whether hardened egress runs through a per-scan proxy SIDECAR rather than the in-process host proxy. True ONLY for rootless

networkListNamesArgs returns the args that list one network name per line. docker/podman support `network ls --filter name= --format {{.Name}}`; Apple

newRepoInput builds a RepoInput and derives Owner/Name from the already-normalised clone URL so every parse path agrees on what those values are.