markNotObserved bumps MissedCount on open findings that this scan was in scope to re-observe (same repo, same skill, same subpath) but whose fingerpri

markRetracted flags findings this scan streamed into the concurrent-finding log but then left out of its final report.json. The row is kept — a siblin

maybeDecrypt transparently decrypts an age-encrypted body. If the body is not encrypted (no age header), it is returned unchanged — so unencrypted imp

maybeFireScanFinalized invokes the OnScanFinalized hook once a scan has finished its analysis with findings committed. A fail_on threshold leaves Stat

mirrorScripts copies the skill's scripts/ directory (if any) to workRoot/scripts/ so the `bash scripts/foo.sh` / `python3 scripts/foo.py` instructions

onScanFinalized is the single OnScanFinalized hook: it computes the fix-validation report for anchor scans and runs the existing post-deep-dive dedup

orgImportConfirm renders the "this will add N repos" confirmation step. htmx clients get an OOB swap that replaces the dialog's input form with a conf

osvAffectedList anchors the finding. Registry packages whose ecosystem the schema recognises become package entries; otherwise the finding is anchored

osvCredits emits the FINDER (when the finding's prior_art names a researcher) and the COORDINATOR (scrutineer's host operator). Schema requires `name`

osvDatabaseSpecific carries scrutineer's code-anchored context that OSV's package-oriented fields cannot express: the file/line location and the audit

osvRelated returns the OSV ids the finding carries via FindingReference rows. Anything tagged `related` is verbatim; CVE and GHSA references fall in a

osvSeverityList emits one CVSS vector entry per version the finding carries (OSV's severity.score is the vector, not a number). Each entry is gated on

parseAdvisoriesOutput replaces Advisory rows for the scan's repository.

parseAnyTime tries the handful of timestamp shapes SQLite gives us back when a column is read via a raw SELECT (no type hint). Returns (zero, false) f

parseLocalInput accepts either file:///abs/path or /abs/path and returns a RepoInput whose CloneURL is file://<cleaned-abs-path>. The path is required

parseMaintainersOutput upserts Maintainer rows and links them to the scanned repo. Mirrors the legacy doMaintainerAnalysis logic so the maintainers sk

parseMarkdownLocation extracts "file:line" and, when the link target is a forge blob URL, the bare repository URL.

parsePartialSkillReport runs parseSkillOutput against a max-turns partial and logs on failure. The scan is already returning a MaxTurnsReachedError so

parseRepoMetadataOutput updates the Repository columns that previously came from the metadata Go handler. Shape matches the subset of repos.ecosyste.m

parseTime accepts RFC3339 or date-only strings. Empty input is not an error; the caller decides whether to omit the field.

pauseQueuedOnAccountError pauses every queued scan behind an account-level Claude failure; queued jobs later drop themselves when wrap sees the DB sta

pickFreeformColumns walks up to 50 items, counts which scalar-shaped keys are commonly present, and returns up to 6 of them. Preferred names (name, ve

preferDep picks the more informative of two Dependency rows for the same package: a runtime-like dependency beats a non-runtime one, and a lockfile ro

prepareDependentSrc updates the shared dependent cache for url under a per-URL lock, then copies it into workRoot/src so the skill operates on its own

profileGuidePath returns the profile's on-disk PROFILE.md if present. The caller mounts it at the agent's project-memory path (CLAUDE.md for claude-co

proxyURLWithHost rewrites the host of a proxy URL, keeping its scheme, the proxy-token userinfo, and port. Apple --hardened scans reach the host proxy

recordSkippedExposure writes an under_investigation row for a dependent we cannot audit (no upstream repo URL) so the per-dependent table on the findi

remoteRunnerDigest fetches the registry digest of the image's current tag (typically :latest) without pulling layers, as a "sha256:<hex>" string direc

renderOrgReport composes the full markdown document. Repos with no findings appear in the count but are omitted from the body so the document is scann

reobserveFinding handles the dedup branch in parseFindingsOutput: bump the seen-count, refresh fields that may drift between scans (location, VID, ref

replaceAutoResume swaps the reset suffix without clobbering the row's detail.

repoScanActionCounts returns the number of cancellable (running/queued) and resumable (paused) scans on a repo, driving the "Cancel all" and "Resume a

resolveAccountReset accepts only fresh, plausible reset times; nil leaves the batch paused for manual resume.

resolvePURLRepo asks packages.ecosyste.ms for the repository_url behind a PURL. Returns empty string if the lookup fails or no repo is recorded.

resolveScanNetworking prepares per-scan networking before the egress proxy starts. In hardened mode it owns its per-scan networks -- the gateway IP is

ruleIndex builds the id→rule map for the ruleId reference path.

runProxy is the entrypoint for `scrutineer proxy`: the egress-proxy sidecar the container runner attaches to a hardened scan's --internal network unde

runnerImageOrSkip returns a locally-present scrutineer-runner image (which carries the scrutineer binary the egress sidecar runs) or skips. Set SCRUTI

runnerImageStatus returns the last recorded staleness result, or the zero value (Stale=false) when the check has not run or found nothing to report.

sameOriginReferer returns the Referer header value only if it points back at this server (same host, or a host-less path). Anything else is dropped so

sarifConfidence maps SARIF properties.precision onto scrutineer's high/medium/low. Absent precision means the source did not say, so leave it empty an

schemaValidationHint tells claude to validate its JSON output against the skill's schema via scrutineer's API instead of installing a JSON Schema libr

seedRepoCache makes a real git repo at the cache path the handler will resolve, with two commits so `git show <commit>:<path>` works for both.

serverRunning reports whether something accepts a TCP connection on addr. It is a best-effort guard: stopping the server is the real precondition for

setupRunner picks the SkillRunner implementation for the run loop: ContainerRunner (docker, podman, or Apple's container) when a container runtime is

sidecarRunning reports whether the named sidecar container is still running. A non-running sidecar during verification means it gave up reaching the h

splitMarkdownFinding separates a single finding's body into its H2 sections and the **Key:** metadata block. The metadata block sits between two --- r

splitSinks tokenises a Finding.Sinks column ("S1, S2") into ids. findings.go writes them comma-joined with a trailing space; older rows might lack the

stageWorkspace writes everything other than ./src into the scan workspace: context.json, the operator's threat-model override, the skill bundle under