resolveDataDir mirrors the server's precedence: an explicit flag wins over the config file's data key, which wins over the ./data default.

resolveEgressSidecar builds the egress proxy sidecar config for a rootless --hardened run. It resolves the default-network host-gateway the sidecar di

resolveMaxTurns picks a scan's turn cap: the skill's own cap when it sets one, else the operator-configured default read live from settings so a chang

runClaudeOnce starts one `claude -p` invocation in work, streams its output through emit, and reports the wait error, whether the run hit the max-turn

runContainerOnce launches one container for the given skill job, appending the in-container `claude` command to runBase, streaming its output through

sarifSeverity maps a result.level plus the GitHub-convention properties.security-severity score onto scrutineer's critical/high/medium/low scale. The

scansCancelAll cancels every queued or running scan on a repository — the bulk companion to the per-row Cancel button, so an operator who fired off a

richFinding seeds one finding with every field the enriched bundle carries, against a fresh repo, and returns the repo. Shared by the bundle-content a

seedScanWithFindings creates a repo + a findings-kind skill + a completed scan with two findings. Used to exercise the findings dispatch path of scanR

setupHardenedNetwork creates the per-scan --internal network for a hardened scan, resolves its host-gateway once, and (on rootless podman) verifies it

severityLabel derives the CVSS base severity from the numeric score per the FIRST spec. The textual Finding.Severity is intentionally ignored: analyst

severityLine renders "Findings: X critical, Y high, Z medium, W low severity", omitting zero-count buckets only for Critical (which most scans never p

severityWeight ranks a repo by the worst severity it carries, so the summary lists the most urgent repos first. Ties broken on total count.

sidecarLogTail returns the tail of the sidecar's logs for error enrichment.

sidecarNetworkIP returns the sidecar's IP on the per-scan --internal network. The scan addresses the sidecar by this IP because that network is create

sidecarReachArgs builds the `run` args for the sidecar variant of probe (b): a throwaway container on the per-scan --internal network that must reach

sourceForToken routes a request through the API auth middleware so the scan context is populated, then reports what sourceFromRequest sees.

sourceFromRequest attributes API PATCH writes: model_suggested when the bearer token scan has a skill, analyst otherwise. Browser form edits do not co

splitAllow turns a comma-separated allowlist into a trimmed, empty-free slice.

startProxySidecar launches the egress proxy as a detached container on the per-scan --internal network, then connects the default (egress) network as

startRunnerLocked builds a fresh goqite runner at the current concurrency, registers the known handlers, and starts it on a child of parentCtx. The ca

stripAutoResume removes existing auto-resume metadata before rewriting it.

stripGitSuffix returns u with any trailing slash and ".git" removed. All major forges clone fine without it and ecosyste.ms / web UIs emit the bare fo

supportsNoNewPrivileges reports whether the runtime accepts Docker/Podman's `--security-opt no-new-privileges` hardening flag.

verifyHardenedNetwork fails closed when the per-scan --internal network does not deliver the isolation --hardened promises. It is used on podman, wher

vidSinks turns a finding's newline-joined Locations into the file:line arguments the vid CLI expects, keeping only entries that resolve to a real file

withPragmas appends connectionPragmas to dsn, joining with ? or & depending on whether dsn already carries a query string (the in-memory test DSNs do)

workspaceScanID returns the scan id whose workspace path a run should use. A fresh scan uses its own id; a retry that resumes a session reuses the lin

BackfillFindings re-parses stored report JSON to fill columns that were added after the findings were originally created. Safe to call repeatedly; onl

Binary is the executable on the runner image's PATH.

DetectProfile runs `brief` against the cloned source inside the default runner image (which already ships brief) and returns the matching profile. Fal

EnqueueRetry re-puts a job on the queue with an attempt count and a delay before it becomes visible. Used by the prereq gate to back off a scan whose

FetchPackagesByPURL resolves a dep's PURL to its upstream package records via packages.ecosyste.ms. Used by the web handler's "import dependency" butt

GuideFilename is the workspace-relative path the harness auto-loads as project memory, where injectProfileGuide writes the profile's PROFILE.md. claud

HasExportableReport tells the UI whether to offer a "download as markdown" button for this scan. A scan that has produced findings is always worth exp

HostGatewaySupported reports whether the detected runtime is known to honour `--add-host host.docker.internal:host-gateway`, which the egress path nee

ListRemoteBranches returns the branch names a remote advertises, for the add-repo form's branch picker. https-only (validated like clone) and best-eff

NeedsKeepID is the exported form of needsKeepID for callers outside the package. The startup path uses it to log a "warming" notice before the keep-id

NewAPIToken returns a 32-byte hex token suitable for bearer auth.

RemoveScanArtifacts deletes the on-disk per-scan workspace and claude session store for scanID. Normal terminal cleanup removes workspaces, while resu

RunSkill runs a skill inside an ephemeral container. The whole workspace (clone + staged .claude/skills + context.json + output) is mounted at work re

RunnerImageRef is the runner image annotated with the git commit it was built from, e.g. "ghcr.io/.../scrutineer-runner @ abc123def456", for the setti

RunnerImageRevision returns the git commit the runner image was built from, read from the org.opencontainers.image.revision OCI label that docker/meta

SetModels replaces the pick list. Called at startup from config; no-op for an empty list so a config with only default_model set keeps the built-in li

SkillDir is where the worker stages SKILL.md/schema.json before calling RunSkill, so the runner's harness discovers it. The path varies per harness (.

SkillDir delegates to the harness so the worker stages SKILL.md where this runner's agent CLI will discover it.

SweepOrphanHardenedNetworks removes per-scan hardened networks left over by previous scrutineer processes (typically after a crash mid-scan). The runt

SweepOrphanProxySidecars force-removes egress proxy sidecar containers left behind by a previous scrutineer process (name prefix proxySidecarPrefix),

SweepRunning marks any scans still flagged running as failed. Call once at startup: a running row with no worker attached means the previous process d

Upsert inserts a new Skill row or updates the existing row with matching name. If the existing row's SourceHash differs from the parsed one, the row's

ValidExposureJustification reports whether j is one of the CSAF VEX flag labels. Empty is valid (no flag attached).

ValidExposureStatus reports whether s is one of the CSAF product_status buckets FindingDependent stores. Empty is treated as under_investigation by th

VerifyKeepID smoke-tests `--userns=keep-id` for rootless podman so a missing or too-small /etc/subuid range fails once at startup with an actionable m

VerifyUpstreamDNS fails closed when the sidecar cannot resolve its allowlisted upstreams. Under rootless --hardened, upstream names (e.g. api.anthropi

anyMarkersMatch reports whether at least one marker is present (OR). An empty list matches (the profile imposes no AnyMarkers constraint); a non-empty

anyPackageHasScope reports whether at least one package carries a direct/transitive scope value; flat-list SBOMs leave them all blank, in which case t

buildCommit reports the commit scrutineer was built from. It prefers the ldflags-injected value (set in the container image build, where .git is exclu

buildScoreMulti derives the CVSS block from the vector itself. The stored f.CVSSScore is intentionally ignored: rows written before the auto-sync land

buildSinkDispositions maps each inventory sink id to its outcome. The deep-dive skill guarantees every inventory entry lands in either a finding's Sin