PyPI - craik - Versions diffs - 0.1.0__tar.gz - Mend

craik 0.1.0__tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (556) hide show

craik-0.1.0/.bandit-baseline.json +2937 -0
craik-0.1.0/.codex/goals.md +7 -0
craik-0.1.0/.github/workflows/ci.yml +230 -0
craik-0.1.0/.github/workflows/codeql.yml +32 -0
craik-0.1.0/.github/workflows/docs.yml +46 -0
craik-0.1.0/.github/workflows/nightly.yml +63 -0
craik-0.1.0/.github/workflows/package.yml +66 -0
craik-0.1.0/.github/workflows/publish.yml +67 -0
craik-0.1.0/.github/workflows/version-consistency.yml +33 -0
craik-0.1.0/.gitignore +13 -0
craik-0.1.0/.gitleaks.toml +20 -0
craik-0.1.0/.pre-commit-config.yaml +9 -0
craik-0.1.0/.readthedocs.yaml +13 -0
craik-0.1.0/CHANGELOG.md +78 -0
craik-0.1.0/CODE_OF_CONDUCT.md +40 -0
craik-0.1.0/CONTRIBUTING.md +83 -0
craik-0.1.0/LICENSE +21 -0
craik-0.1.0/MAINTAINERS.md +65 -0
craik-0.1.0/PKG-INFO +311 -0
craik-0.1.0/README.md +282 -0
craik-0.1.0/SECURITY.md +60 -0
craik-0.1.0/TRADEMARKS.md +32 -0
craik-0.1.0/docs/.gitignore +3 -0
craik-0.1.0/docs/adr/0001-record-mvp-runner-scope.md +36 -0
craik-0.1.0/docs/adr/0002-provider-transport-and-mode-families.md +39 -0
craik-0.1.0/docs/adr/0003-secret-handling.md +38 -0
craik-0.1.0/docs/adr/0004-policy-envelope-shape.md +36 -0
craik-0.1.0/docs/adr/0005-receipts-and-handoffs-as-public-contracts.md +38 -0
craik-0.1.0/docs/adr/0006-package-and-runtime-layout.md +41 -0
craik-0.1.0/docs/adr/0007-credential-and-identity-architecture.md +80 -0
craik-0.1.0/docs/adr/index.md +13 -0
craik-0.1.0/docs/architecture.md +203 -0
craik-0.1.0/docs/blog/.gitkeep +1 -0
craik-0.1.0/docs/concepts/case-files.md +63 -0
craik-0.1.0/docs/concepts/governance.md +48 -0
craik-0.1.0/docs/concepts/handoffs.md +46 -0
craik-0.1.0/docs/concepts/intent-locks.md +37 -0
craik-0.1.0/docs/concepts/memory-and-stigmem.md +46 -0
craik-0.1.0/docs/concepts/project-model.md +45 -0
craik-0.1.0/docs/concepts/receipts.md +65 -0
craik-0.1.0/docs/concepts/single-agent-loop.md +82 -0
craik-0.1.0/docs/concepts/work-graph.md +28 -0
craik-0.1.0/docs/differentiators.md +735 -0
craik-0.1.0/docs/docs/.gitkeep +1 -0
craik-0.1.0/docs/docusaurus.config.js +144 -0
craik-0.1.0/docs/features.md +587 -0
craik-0.1.0/docs/governance.md +295 -0
craik-0.1.0/docs/guides/agent-onboarding.md +59 -0
craik-0.1.0/docs/guides/authentication.md +215 -0
craik-0.1.0/docs/guides/capability-grants.md +56 -0
craik-0.1.0/docs/guides/community-plugins.md +78 -0
craik-0.1.0/docs/guides/community-skills.md +62 -0
craik-0.1.0/docs/guides/companion-app-security.md +118 -0
craik-0.1.0/docs/guides/configuring-craik-home.md +28 -0
craik-0.1.0/docs/guides/connecting-stigmem.md +64 -0
craik-0.1.0/docs/guides/context-budgeting.md +57 -0
craik-0.1.0/docs/guides/contradiction-inbox.md +51 -0
craik-0.1.0/docs/guides/development.md +14 -0
craik-0.1.0/docs/guides/doctor.md +58 -0
craik-0.1.0/docs/guides/evidence-and-assumptions.md +34 -0
craik-0.1.0/docs/guides/fail-open.md +25 -0
craik-0.1.0/docs/guides/gateway-troubleshooting.md +108 -0
craik-0.1.0/docs/guides/github-adapter.md +27 -0
craik-0.1.0/docs/guides/installation.md +43 -0
craik-0.1.0/docs/guides/learning-loops.md +117 -0
craik-0.1.0/docs/guides/local-store-migrations.md +40 -0
craik-0.1.0/docs/guides/mcp-ecosystem-compatibility.md +99 -0
craik-0.1.0/docs/guides/memory-diffs.md +22 -0
craik-0.1.0/docs/guides/memory-impact-preview.md +21 -0
craik-0.1.0/docs/guides/memory-proposals.md +67 -0
craik-0.1.0/docs/guides/project-registry.md +34 -0
craik-0.1.0/docs/guides/provider-routing.md +119 -0
craik-0.1.0/docs/guides/quickstart.md +117 -0
craik-0.1.0/docs/guides/release-management.md +87 -0
craik-0.1.0/docs/guides/runner-preview-workflows.md +143 -0
craik-0.1.0/docs/guides/running-policy-tests.md +42 -0
craik-0.1.0/docs/guides/scope-control.md +46 -0
craik-0.1.0/docs/guides/setup.md +48 -0
craik-0.1.0/docs/guides/single-agent-fixture-loop.md +51 -0
craik-0.1.0/docs/guides/stigmem-docs-demo.md +132 -0
craik-0.1.0/docs/guides/translated-docs.md +98 -0
craik-0.1.0/docs/guides/updating.md +34 -0
craik-0.1.0/docs/guides/using-case-files.md +67 -0
craik-0.1.0/docs/guides/writing-handoffs.md +42 -0
craik-0.1.0/docs/implementation-plan.md +673 -0
craik-0.1.0/docs/index.md +176 -0
craik-0.1.0/docs/limitations.md +87 -0
craik-0.1.0/docs/mvp-roadmap.md +240 -0
craik-0.1.0/docs/mvp.md +227 -0
craik-0.1.0/docs/package-lock.json +20503 -0
craik-0.1.0/docs/package.json +41 -0
craik-0.1.0/docs/product-strategy.md +251 -0
craik-0.1.0/docs/reference/accessibility-requirements.md +44 -0
craik-0.1.0/docs/reference/adapter-packages.md +22 -0
craik-0.1.0/docs/reference/adjacent-runtime-bridge.md +48 -0
craik-0.1.0/docs/reference/adjacent-tool-migration.md +43 -0
craik-0.1.0/docs/reference/agent-roles.md +26 -0
craik-0.1.0/docs/reference/browser-tool-boundary.md +40 -0
craik-0.1.0/docs/reference/budget-quota-view.md +25 -0
craik-0.1.0/docs/reference/channel-adapter-contract.md +81 -0
craik-0.1.0/docs/reference/channel-allowlists.md +52 -0
craik-0.1.0/docs/reference/channel-identity-pairing.md +56 -0
craik-0.1.0/docs/reference/channel-policy-envelopes.md +46 -0
craik-0.1.0/docs/reference/ci-cd.md +94 -0
craik-0.1.0/docs/reference/claude-runner-adapter.md +66 -0
craik-0.1.0/docs/reference/cli.md +829 -0
craik-0.1.0/docs/reference/codex-runner-adapter.md +67 -0
craik-0.1.0/docs/reference/config.md +79 -0
craik-0.1.0/docs/reference/context-debt.md +24 -0
craik-0.1.0/docs/reference/contradiction-inbox-view.md +29 -0
craik-0.1.0/docs/reference/cross-agent-review.md +34 -0
craik-0.1.0/docs/reference/debates.md +41 -0
craik-0.1.0/docs/reference/delegation-queue-view.md +31 -0
craik-0.1.0/docs/reference/desktop-companion.md +49 -0
craik-0.1.0/docs/reference/docker-sandbox-backend.md +40 -0
craik-0.1.0/docs/reference/environment-receipts.md +41 -0
craik-0.1.0/docs/reference/evidence-assumption-view.md +30 -0
craik-0.1.0/docs/reference/exit-discipline.md +20 -0
craik-0.1.0/docs/reference/failure-modes.md +55 -0
craik-0.1.0/docs/reference/freshness.md +24 -0
craik-0.1.0/docs/reference/gateway-daemon.md +39 -0
craik-0.1.0/docs/reference/gateway-receipts.md +49 -0
craik-0.1.0/docs/reference/gemini-runner-adapter.md +68 -0
craik-0.1.0/docs/reference/github-config.md +16 -0
craik-0.1.0/docs/reference/graph-export.md +22 -0
craik-0.1.0/docs/reference/handoff-viewer.md +27 -0
craik-0.1.0/docs/reference/human-delegation.md +35 -0
craik-0.1.0/docs/reference/import-dry-run.md +45 -0
craik-0.1.0/docs/reference/instruction-distillation-view.md +33 -0
craik-0.1.0/docs/reference/instruction-distillation-workflow.md +46 -0
craik-0.1.0/docs/reference/instruction-sources.md +130 -0
craik-0.1.0/docs/reference/known-traps-view.md +32 -0
craik-0.1.0/docs/reference/known-traps.md +19 -0
craik-0.1.0/docs/reference/learning-receipts.md +32 -0
craik-0.1.0/docs/reference/local-process-backend.md +41 -0
craik-0.1.0/docs/reference/local-state.md +44 -0
craik-0.1.0/docs/reference/local-store.md +125 -0
craik-0.1.0/docs/reference/locale-i18n-framework.md +65 -0
craik-0.1.0/docs/reference/mcp-client.md +44 -0
craik-0.1.0/docs/reference/mcp-export-boundary.md +63 -0
craik-0.1.0/docs/reference/memory-backends.md +82 -0
craik-0.1.0/docs/reference/memory-impact-preview-view.md +34 -0
craik-0.1.0/docs/reference/memory-review-nudges.md +31 -0
craik-0.1.0/docs/reference/messaging-channel-adapter.md +80 -0
craik-0.1.0/docs/reference/migration-maps.md +37 -0
craik-0.1.0/docs/reference/mobile-companion.md +52 -0
craik-0.1.0/docs/reference/model-providers.md +123 -0
craik-0.1.0/docs/reference/multi-agent-workflow-bridge.md +50 -0
craik-0.1.0/docs/reference/multi-agent-workflow-migration.md +42 -0
craik-0.1.0/docs/reference/multimodal-artifacts.md +43 -0
craik-0.1.0/docs/reference/operator-surface.md +74 -0
craik-0.1.0/docs/reference/plugin-capability-grants.md +32 -0
craik-0.1.0/docs/reference/plugin-descriptors.md +30 -0
craik-0.1.0/docs/reference/plugin-probation.md +30 -0
craik-0.1.0/docs/reference/plugin-receipts.md +28 -0
craik-0.1.0/docs/reference/policy-profiles.md +98 -0
craik-0.1.0/docs/reference/policy-tests.md +42 -0
craik-0.1.0/docs/reference/post-mvp-scope.md +55 -0
craik-0.1.0/docs/reference/preference-facts.md +32 -0
craik-0.1.0/docs/reference/project-profile.md +51 -0
craik-0.1.0/docs/reference/prompt-compiler.md +59 -0
craik-0.1.0/docs/reference/provider-certification.md +75 -0
craik-0.1.0/docs/reference/provider-failover.md +47 -0
craik-0.1.0/docs/reference/provider-switching.md +56 -0
craik-0.1.0/docs/reference/public-boundary-provenance.md +32 -0
craik-0.1.0/docs/reference/quality-gate-view.md +37 -0
craik-0.1.0/docs/reference/quality-scores.md +39 -0
craik-0.1.0/docs/reference/receipt-viewer.md +29 -0
craik-0.1.0/docs/reference/recovery.md +39 -0
craik-0.1.0/docs/reference/redaction.md +57 -0
craik-0.1.0/docs/reference/reference-integrations.md +28 -0
craik-0.1.0/docs/reference/remote-shell-backend.md +48 -0
craik-0.1.0/docs/reference/run-delta-view.md +27 -0
craik-0.1.0/docs/reference/run-state.md +67 -0
craik-0.1.0/docs/reference/runner-adapter-contract.md +198 -0
craik-0.1.0/docs/reference/runner-metadata.md +41 -0
craik-0.1.0/docs/reference/runner-step-contracts.md +41 -0
craik-0.1.0/docs/reference/runtime-critics.md +42 -0
craik-0.1.0/docs/reference/sandbox-backends.md +57 -0
craik-0.1.0/docs/reference/scheduled-automations.md +42 -0
craik-0.1.0/docs/reference/scheduled-task-creation.md +49 -0
craik-0.1.0/docs/reference/schemas.md +128 -0
craik-0.1.0/docs/reference/scratchpad-and-unknowns.md +15 -0
craik-0.1.0/docs/reference/secret-migration-policy.md +53 -0
craik-0.1.0/docs/reference/self-audit.md +17 -0
craik-0.1.0/docs/reference/side-effect-wrappers.md +31 -0
craik-0.1.0/docs/reference/skill-contexts.md +30 -0
craik-0.1.0/docs/reference/skill-packages.md +18 -0
craik-0.1.0/docs/reference/skill-promotion-gates.md +50 -0
craik-0.1.0/docs/reference/skill-proposals.md +55 -0
craik-0.1.0/docs/reference/skill-registries.md +35 -0
craik-0.1.0/docs/reference/skill-replay.md +36 -0
craik-0.1.0/docs/reference/skill-rollbacks.md +42 -0
craik-0.1.0/docs/reference/skill-telemetry.md +35 -0
craik-0.1.0/docs/reference/speech-to-text-adapters.md +56 -0
craik-0.1.0/docs/reference/stigmem-compatibility.md +34 -0
craik-0.1.0/docs/reference/text-to-speech-adapters.md +53 -0
craik-0.1.0/docs/reference/trajectory-exports.md +75 -0
craik-0.1.0/docs/reference/visual-workspace.md +45 -0
craik-0.1.0/docs/reference/voice-posture.md +60 -0
craik-0.1.0/docs/reference/webhook-ingress.md +53 -0
craik-0.1.0/docs/reference/work-graph-explorer.md +24 -0
craik-0.1.0/docs/reference/work-graph-visual-bridge.md +52 -0
craik-0.1.0/docs/reference/worker-results.md +36 -0
craik-0.1.0/docs/release-readiness-v0.1.0.md +120 -0
craik-0.1.0/docs/roadmap.md +1388 -0
craik-0.1.0/docs/runtime-contracts.md +361 -0
craik-0.1.0/docs/security/release-process.md +45 -0
craik-0.1.0/docs/security/secrets.md +24 -0
craik-0.1.0/docs/sidebars.js +143 -0
craik-0.1.0/docs/src/css/custom.css +70 -0
craik-0.1.0/docs/src/pages/index.js +49 -0
craik-0.1.0/docs/static/img/favicon.ico +1 -0
craik-0.1.0/docs/static/img/logo.svg +5 -0
craik-0.1.0/docs/stigmem-integration.md +316 -0
craik-0.1.0/docs/vision.md +77 -0
craik-0.1.0/pyproject.toml +85 -0
craik-0.1.0/scripts/check_changed_file_strictness.py +61 -0
craik-0.1.0/scripts/check_max_file_lines.py +38 -0
craik-0.1.0/scripts/check_public_docs_hygiene.py +27 -0
craik-0.1.0/scripts/check_release_readiness.py +69 -0
craik-0.1.0/scripts/check_release_tag.py +71 -0
craik-0.1.0/scripts/check_release_version.py +33 -0
craik-0.1.0/scripts/check_version_consistency.py +57 -0
craik-0.1.0/scripts/generate_cli_reference.py +127 -0
craik-0.1.0/scripts/quickstart_smoke.py +109 -0
craik-0.1.0/scripts/write_conformance_report.py +61 -0
craik-0.1.0/src/craik/__init__.py +5 -0
craik-0.1.0/src/craik/cli.py +231 -0
craik-0.1.0/src/craik/cli_auth.py +405 -0
craik-0.1.0/src/craik/cli_connect.py +46 -0
craik-0.1.0/src/craik/cli_demos.py +132 -0
craik-0.1.0/src/craik/cli_handoffs.py +133 -0
craik-0.1.0/src/craik/cli_onboarding.py +63 -0
craik-0.1.0/src/craik/cli_operations.py +480 -0
craik-0.1.0/src/craik/cli_project.py +473 -0
craik-0.1.0/src/craik/cli_receipts.py +61 -0
craik-0.1.0/src/craik/cli_runs.py +299 -0
craik-0.1.0/src/craik/contracts/__init__.py +151 -0
craik-0.1.0/src/craik/contracts/models/__init__.py +14 -0
craik-0.1.0/src/craik/contracts/models/base.py +325 -0
craik-0.1.0/src/craik/contracts/models/core.py +310 -0
craik-0.1.0/src/craik/contracts/models/handoffs.py +202 -0
craik-0.1.0/src/craik/contracts/models/instructions.py +323 -0
craik-0.1.0/src/craik/contracts/models/memory.py +602 -0
craik-0.1.0/src/craik/contracts/models/review.py +400 -0
craik-0.1.0/src/craik/contracts/models/runtime.py +389 -0
craik-0.1.0/src/craik/contracts/models/skills.py +527 -0
craik-0.1.0/src/craik/contracts/registry.py +173 -0
craik-0.1.0/src/craik/contracts/runner_models.py +160 -0
craik-0.1.0/src/craik/py.typed +1 -0
craik-0.1.0/src/craik/runtime/__init__.py +137 -0
craik-0.1.0/src/craik/runtime/auth/__init__.py +42 -0
craik-0.1.0/src/craik/runtime/auth/operator/__init__.py +37 -0
craik-0.1.0/src/craik/runtime/auth/operator/cache_control.py +26 -0
craik-0.1.0/src/craik/runtime/auth/operator/context.py +38 -0
craik-0.1.0/src/craik/runtime/auth/operator/oidc.py +496 -0
craik-0.1.0/src/craik/runtime/auth/operator/session.py +22 -0
craik-0.1.0/src/craik/runtime/auth/operator/store.py +181 -0
craik-0.1.0/src/craik/runtime/auth/pool.py +264 -0
craik-0.1.0/src/craik/runtime/auth/profile.py +87 -0
craik-0.1.0/src/craik/runtime/auth/sources/__init__.py +46 -0
craik-0.1.0/src/craik/runtime/auth/sources/api_key.py +44 -0
craik-0.1.0/src/craik/runtime/auth/sources/cli_bridge.py +156 -0
craik-0.1.0/src/craik/runtime/auth/sources/factory.py +128 -0
craik-0.1.0/src/craik/runtime/auth/sources/local_cli_oauth.py +243 -0
craik-0.1.0/src/craik/runtime/auth/sources/oidc_exchange.py +89 -0
craik-0.1.0/src/craik/runtime/auth/sources/secret_ref.py +114 -0
craik-0.1.0/src/craik/runtime/auth/sources/stigmem_ref.py +84 -0
craik-0.1.0/src/craik/runtime/auth/store.py +285 -0
craik-0.1.0/src/craik/runtime/auth/url_safety.py +23 -0
craik-0.1.0/src/craik/runtime/auth/workload/__init__.py +19 -0
craik-0.1.0/src/craik/runtime/auth/workload/oidc_federation.py +155 -0
craik-0.1.0/src/craik/runtime/bridges/__init__.py +0 -0
craik-0.1.0/src/craik/runtime/bridges/adjacent_runtime_bridge.py +129 -0
craik-0.1.0/src/craik/runtime/bridges/multi_agent_workflow_bridge.py +139 -0
craik-0.1.0/src/craik/runtime/channels/__init__.py +4 -0
craik-0.1.0/src/craik/runtime/channels/allowlist.py +140 -0
craik-0.1.0/src/craik/runtime/channels/identity.py +89 -0
craik-0.1.0/src/craik/runtime/channels/messaging.py +182 -0
craik-0.1.0/src/craik/runtime/channels/policy.py +144 -0
craik-0.1.0/src/craik/runtime/channels/scheduled_automations.py +129 -0
craik-0.1.0/src/craik/runtime/channels/schedules.py +99 -0
craik-0.1.0/src/craik/runtime/channels/webhook_ingress.py +149 -0
craik-0.1.0/src/craik/runtime/companions/__init__.py +0 -0
craik-0.1.0/src/craik/runtime/companions/accessibility.py +69 -0
craik-0.1.0/src/craik/runtime/companions/desktop_companion.py +110 -0
craik-0.1.0/src/craik/runtime/companions/locale_i18n.py +163 -0
craik-0.1.0/src/craik/runtime/companions/mobile_companion.py +115 -0
craik-0.1.0/src/craik/runtime/companions/operator_artifact_views.py +193 -0
craik-0.1.0/src/craik/runtime/companions/operator_views.py +484 -0
craik-0.1.0/src/craik/runtime/companions/visual_workspace.py +104 -0
craik-0.1.0/src/craik/runtime/companions/work_graph_visual.py +157 -0
craik-0.1.0/src/craik/runtime/doctor.py +336 -0
craik-0.1.0/src/craik/runtime/environment_receipts.py +124 -0
craik-0.1.0/src/craik/runtime/gateway.py +120 -0
craik-0.1.0/src/craik/runtime/gateway_receipts.py +100 -0
craik-0.1.0/src/craik/runtime/github.py +276 -0
craik-0.1.0/src/craik/runtime/memory/__init__.py +7 -0
craik-0.1.0/src/craik/runtime/memory/contradictions.py +101 -0
craik-0.1.0/src/craik/runtime/memory/diff.py +151 -0
craik-0.1.0/src/craik/runtime/memory/freshness.py +71 -0
craik-0.1.0/src/craik/runtime/memory/local_stores.py +171 -0
craik-0.1.0/src/craik/runtime/memory/memory.py +387 -0
craik-0.1.0/src/craik/runtime/memory/memory_errors.py +35 -0
craik-0.1.0/src/craik/runtime/memory/memory_hygiene.py +64 -0
craik-0.1.0/src/craik/runtime/memory/memory_proposals.py +115 -0
craik-0.1.0/src/craik/runtime/memory/memory_review.py +96 -0
craik-0.1.0/src/craik/runtime/memory/operator_memory_views.py +108 -0
craik-0.1.0/src/craik/runtime/memory/preference_facts.py +69 -0
craik-0.1.0/src/craik/runtime/paths.py +134 -0
craik-0.1.0/src/craik/runtime/policy/__init__.py +7 -0
craik-0.1.0/src/craik/runtime/policy/credential_policy.py +95 -0
craik-0.1.0/src/craik/runtime/policy/intent_locks.py +93 -0
craik-0.1.0/src/craik/runtime/policy/operator_policy.py +104 -0
craik-0.1.0/src/craik/runtime/policy/policy.py +489 -0
craik-0.1.0/src/craik/runtime/policy/policy_tests.py +353 -0
craik-0.1.0/src/craik/runtime/policy/redaction.py +177 -0
craik-0.1.0/src/craik/runtime/projects/__init__.py +0 -0
craik-0.1.0/src/craik/runtime/projects/demos.py +473 -0
craik-0.1.0/src/craik/runtime/projects/demos_provider.py +57 -0
craik-0.1.0/src/craik/runtime/projects/git_commands.py +36 -0
craik-0.1.0/src/craik/runtime/projects/import_dry_run.py +100 -0
craik-0.1.0/src/craik/runtime/projects/instruction_sources.py +353 -0
craik-0.1.0/src/craik/runtime/projects/migration_assessment.py +124 -0
craik-0.1.0/src/craik/runtime/projects/migration_maps.py +54 -0
craik-0.1.0/src/craik/runtime/projects/onboarding.py +298 -0
craik-0.1.0/src/craik/runtime/projects/project_registry.py +143 -0
craik-0.1.0/src/craik/runtime/projects/prompts.py +266 -0
craik-0.1.0/src/craik/runtime/projects/public_docs.py +196 -0
craik-0.1.0/src/craik/runtime/projects/secret_migration.py +152 -0
craik-0.1.0/src/craik/runtime/projects/update_guidance.py +33 -0
craik-0.1.0/src/craik/runtime/providers/__init__.py +0 -0
craik-0.1.0/src/craik/runtime/providers/http_transport.py +157 -0
craik-0.1.0/src/craik/runtime/providers/model_providers.py +362 -0
craik-0.1.0/src/craik/runtime/providers/provider_budgets.py +75 -0
craik-0.1.0/src/craik/runtime/providers/provider_certification.py +99 -0
craik-0.1.0/src/craik/runtime/providers/provider_config.py +85 -0
craik-0.1.0/src/craik/runtime/providers/provider_execution.py +329 -0
craik-0.1.0/src/craik/runtime/providers/provider_failover.py +88 -0
craik-0.1.0/src/craik/runtime/providers/provider_models.py +131 -0
craik-0.1.0/src/craik/runtime/providers/provider_runner.py +342 -0
craik-0.1.0/src/craik/runtime/providers/provider_runtime.py +442 -0
craik-0.1.0/src/craik/runtime/providers/provider_runtime_support.py +423 -0
craik-0.1.0/src/craik/runtime/providers/provider_transport.py +184 -0
craik-0.1.0/src/craik/runtime/providers/provider_url_safety.py +33 -0
craik-0.1.0/src/craik/runtime/reviewing/__init__.py +0 -0
craik-0.1.0/src/craik/runtime/reviewing/critics.py +92 -0
craik-0.1.0/src/craik/runtime/reviewing/debates.py +165 -0
craik-0.1.0/src/craik/runtime/reviewing/delegations.py +68 -0
craik-0.1.0/src/craik/runtime/reviewing/investigations.py +211 -0
craik-0.1.0/src/craik/runtime/reviewing/reviews.py +103 -0
craik-0.1.0/src/craik/runtime/runners/__init__.py +7 -0
craik-0.1.0/src/craik/runtime/runners/claude_adapter.py +61 -0
craik-0.1.0/src/craik/runtime/runners/codex_adapter.py +61 -0
craik-0.1.0/src/craik/runtime/runners/gemini_adapter.py +61 -0
craik-0.1.0/src/craik/runtime/runners/preview_adapter.py +267 -0
craik-0.1.0/src/craik/runtime/runners/runner_metadata.py +70 -0
craik-0.1.0/src/craik/runtime/runners/runners.py +341 -0
craik-0.1.0/src/craik/runtime/sandbox/__init__.py +0 -0
craik-0.1.0/src/craik/runtime/sandbox/browser_tool_boundary.py +148 -0
craik-0.1.0/src/craik/runtime/sandbox/docker_sandbox_backend.py +131 -0
craik-0.1.0/src/craik/runtime/sandbox/local_process_backend.py +103 -0
craik-0.1.0/src/craik/runtime/sandbox/mcp_client.py +137 -0
craik-0.1.0/src/craik/runtime/sandbox/mcp_export.py +89 -0
craik-0.1.0/src/craik/runtime/sandbox/remote_shell_backend.py +184 -0
craik-0.1.0/src/craik/runtime/secrets.py +53 -0
craik-0.1.0/src/craik/runtime/side_effects.py +246 -0
craik-0.1.0/src/craik/runtime/skills/__init__.py +0 -0
craik-0.1.0/src/craik/runtime/skills/learning_receipts.py +128 -0
craik-0.1.0/src/craik/runtime/skills/skill_promotions.py +137 -0
craik-0.1.0/src/craik/runtime/skills/skill_proposals.py +111 -0
craik-0.1.0/src/craik/runtime/skills/skill_replay.py +141 -0
craik-0.1.0/src/craik/runtime/skills/skill_rollbacks.py +132 -0
craik-0.1.0/src/craik/runtime/skills/skill_telemetry.py +120 -0
craik-0.1.0/src/craik/runtime/skills/trajectory_exports.py +311 -0
craik-0.1.0/src/craik/runtime/store/__init__.py +45 -0
craik-0.1.0/src/craik/runtime/store/base.py +468 -0
craik-0.1.0/src/craik/runtime/store/extensions.py +317 -0
craik-0.1.0/src/craik/runtime/store/memory.py +131 -0
craik-0.1.0/src/craik/runtime/store/profiles.py +121 -0
craik-0.1.0/src/craik/runtime/store/work.py +253 -0
craik-0.1.0/src/craik/runtime/store_kinds.py +68 -0
craik-0.1.0/src/craik/runtime/voice/__init__.py +0 -0
craik-0.1.0/src/craik/runtime/voice/multimodal_artifacts.py +155 -0
craik-0.1.0/src/craik/runtime/voice/speech_to_text.py +165 -0
craik-0.1.0/src/craik/runtime/voice/text_to_speech.py +152 -0
craik-0.1.0/src/craik/runtime/voice/voice_posture.py +101 -0
craik-0.1.0/src/craik/runtime/work/__init__.py +0 -0
craik-0.1.0/src/craik/runtime/work/case_files.py +491 -0
craik-0.1.0/src/craik/runtime/work/case_support/__init__.py +19 -0
craik-0.1.0/src/craik/runtime/work/case_support/context.py +168 -0
craik-0.1.0/src/craik/runtime/work/case_support/credential_risks.py +96 -0
craik-0.1.0/src/craik/runtime/work/case_support/receipts.py +36 -0
craik-0.1.0/src/craik/runtime/work/context_debt.py +202 -0
craik-0.1.0/src/craik/runtime/work/exit_discipline.py +57 -0
craik-0.1.0/src/craik/runtime/work/graph.py +348 -0
craik-0.1.0/src/craik/runtime/work/handoffs.py +499 -0
craik-0.1.0/src/craik/runtime/work/known_traps.py +61 -0
craik-0.1.0/src/craik/runtime/work/loop.py +493 -0
craik-0.1.0/src/craik/runtime/work/loop_support/__init__.py +1 -0
craik-0.1.0/src/craik/runtime/work/loop_support/tool_dispatch.py +137 -0
craik-0.1.0/src/craik/runtime/work/quality_scores.py +201 -0
craik-0.1.0/src/craik/runtime/work/receipts.py +101 -0
craik-0.1.0/src/craik/runtime/work/recovery.py +303 -0
craik-0.1.0/src/craik/runtime/work/run_outputs.py +151 -0
craik-0.1.0/src/craik/runtime/work/runs.py +147 -0
craik-0.1.0/src/craik/runtime/work/scratchpad.py +48 -0
craik-0.1.0/src/craik/runtime/work/tasks.py +48 -0
craik-0.1.0/tests/fixtures/cassettes/chat_completions_recorded.json +30 -0
craik-0.1.0/tests/fixtures/contracts/v0_1/contracts.json +2039 -0
craik-0.1.0/tests/fixtures/local_store/v1/schema.sql +18 -0
craik-0.1.0/tests/integration/test_chat_completions_live.py +124 -0
craik-0.1.0/tests/integration/test_http_transport_round_trip.py +208 -0
craik-0.1.0/tests/test_accessibility.py +58 -0
craik-0.1.0/tests/test_adapter_packages.py +78 -0
craik-0.1.0/tests/test_adjacent_runtime_bridge.py +187 -0
craik-0.1.0/tests/test_agent_roles.py +82 -0
craik-0.1.0/tests/test_auth_api_key_source.py +65 -0
craik-0.1.0/tests/test_auth_cli_bridge.py +105 -0
craik-0.1.0/tests/test_auth_credential_pool.py +107 -0
craik-0.1.0/tests/test_auth_local_cli_oauth.py +132 -0
craik-0.1.0/tests/test_auth_profile_store.py +136 -0
craik-0.1.0/tests/test_auth_profiles.py +217 -0
craik-0.1.0/tests/test_auth_secret_ref.py +127 -0
craik-0.1.0/tests/test_browser_tool_boundary.py +134 -0
craik-0.1.0/tests/test_case_files.py +453 -0
craik-0.1.0/tests/test_channel_adapters.py +116 -0
craik-0.1.0/tests/test_channel_allowlist.py +139 -0
craik-0.1.0/tests/test_channel_identity.py +157 -0
craik-0.1.0/tests/test_channel_policy.py +193 -0
craik-0.1.0/tests/test_claude_adapter.py +111 -0
craik-0.1.0/tests/test_cli.py +1213 -0
craik-0.1.0/tests/test_codex_adapter.py +111 -0
craik-0.1.0/tests/test_context_debt.py +99 -0
craik-0.1.0/tests/test_contracts.py +287 -0
craik-0.1.0/tests/test_contradictions.py +115 -0
craik-0.1.0/tests/test_critics.py +113 -0
craik-0.1.0/tests/test_debates.py +159 -0
craik-0.1.0/tests/test_delegations.py +196 -0
craik-0.1.0/tests/test_demos.py +188 -0
craik-0.1.0/tests/test_desktop_companion.py +133 -0
craik-0.1.0/tests/test_docker_sandbox_backend.py +146 -0
craik-0.1.0/tests/test_docs.py +97 -0
craik-0.1.0/tests/test_doctor.py +125 -0
craik-0.1.0/tests/test_ecosystem_compatibility.py +201 -0
craik-0.1.0/tests/test_environment_receipts.py +106 -0
craik-0.1.0/tests/test_exit_discipline.py +94 -0
craik-0.1.0/tests/test_freshness.py +110 -0
craik-0.1.0/tests/test_gateway.py +103 -0
craik-0.1.0/tests/test_gateway_receipts.py +90 -0
craik-0.1.0/tests/test_gemini_adapter.py +111 -0
craik-0.1.0/tests/test_git_commands.py +50 -0
craik-0.1.0/tests/test_github.py +273 -0
craik-0.1.0/tests/test_graph.py +114 -0
craik-0.1.0/tests/test_handoffs.py +375 -0
craik-0.1.0/tests/test_http_transport.py +400 -0
craik-0.1.0/tests/test_import_dry_run.py +126 -0
craik-0.1.0/tests/test_instruction_contradictions.py +148 -0
craik-0.1.0/tests/test_instruction_distillation.py +133 -0
craik-0.1.0/tests/test_instruction_invalidation.py +189 -0
craik-0.1.0/tests/test_instruction_promotion.py +127 -0
craik-0.1.0/tests/test_instruction_provenance.py +118 -0
craik-0.1.0/tests/test_instruction_runtime_context.py +158 -0
craik-0.1.0/tests/test_instruction_sources.py +117 -0
craik-0.1.0/tests/test_instruction_workflow_docs.py +37 -0
craik-0.1.0/tests/test_intent_locks.py +81 -0
craik-0.1.0/tests/test_investigations.py +197 -0
craik-0.1.0/tests/test_known_traps.py +103 -0
craik-0.1.0/tests/test_learning_receipts.py +95 -0
craik-0.1.0/tests/test_local_process_backend.py +130 -0
craik-0.1.0/tests/test_locale_i18n.py +126 -0
craik-0.1.0/tests/test_loop.py +426 -0
craik-0.1.0/tests/test_loop_tool_dispatch.py +108 -0
craik-0.1.0/tests/test_mcp_client.py +125 -0
craik-0.1.0/tests/test_mcp_export.py +109 -0
craik-0.1.0/tests/test_memory.py +413 -0
craik-0.1.0/tests/test_memory_hygiene.py +92 -0
craik-0.1.0/tests/test_memory_review.py +103 -0
craik-0.1.0/tests/test_messaging_channel.py +115 -0
craik-0.1.0/tests/test_migration_assessment.py +222 -0
craik-0.1.0/tests/test_migration_maps.py +114 -0
craik-0.1.0/tests/test_mobile_companion.py +138 -0
craik-0.1.0/tests/test_model_providers.py +150 -0
craik-0.1.0/tests/test_multi_agent_workflow_bridge.py +218 -0
craik-0.1.0/tests/test_multimodal_artifacts.py +138 -0
craik-0.1.0/tests/test_mvp_hardening.py +250 -0
craik-0.1.0/tests/test_oidc_exchange_secret_manager.py +153 -0
craik-0.1.0/tests/test_oidc_fuzz.py +144 -0
craik-0.1.0/tests/test_oidc_https_enforcement.py +83 -0
craik-0.1.0/tests/test_oidc_jwks_cache_control.py +80 -0
craik-0.1.0/tests/test_oidc_operator.py +318 -0
craik-0.1.0/tests/test_oidc_state_validation.py +106 -0
craik-0.1.0/tests/test_onboarding.py +121 -0
craik-0.1.0/tests/test_operator_session_store.py +272 -0
craik-0.1.0/tests/test_operator_views.py +1068 -0
craik-0.1.0/tests/test_paths.py +75 -0
craik-0.1.0/tests/test_plugin_grants.py +97 -0
craik-0.1.0/tests/test_plugin_probation.py +114 -0
craik-0.1.0/tests/test_plugin_receipts.py +87 -0
craik-0.1.0/tests/test_plugins.py +105 -0
craik-0.1.0/tests/test_policy.py +375 -0
craik-0.1.0/tests/test_policy_tests.py +47 -0
craik-0.1.0/tests/test_preference_facts.py +89 -0
craik-0.1.0/tests/test_project_registry.py +128 -0
craik-0.1.0/tests/test_prompts.py +150 -0
craik-0.1.0/tests/test_provider_base_url_safety.py +129 -0
craik-0.1.0/tests/test_provider_budgets.py +86 -0
craik-0.1.0/tests/test_provider_certification.py +85 -0
craik-0.1.0/tests/test_provider_cli.py +80 -0
craik-0.1.0/tests/test_provider_failover.py +107 -0
craik-0.1.0/tests/test_provider_runner.py +176 -0
craik-0.1.0/tests/test_provider_runtime.py +1387 -0
craik-0.1.0/tests/test_public_docs.py +74 -0
craik-0.1.0/tests/test_quality_scores.py +131 -0
craik-0.1.0/tests/test_receipts.py +276 -0
craik-0.1.0/tests/test_recovery.py +172 -0
craik-0.1.0/tests/test_redaction.py +211 -0
craik-0.1.0/tests/test_reference_integrations.py +80 -0
craik-0.1.0/tests/test_remote_shell_backend.py +167 -0
craik-0.1.0/tests/test_reviews.py +215 -0
craik-0.1.0/tests/test_run_outputs.py +128 -0
craik-0.1.0/tests/test_runner_metadata.py +47 -0
craik-0.1.0/tests/test_runner_steps.py +67 -0
craik-0.1.0/tests/test_runners.py +158 -0
craik-0.1.0/tests/test_runs.py +144 -0
craik-0.1.0/tests/test_runtime_layout.py +28 -0
craik-0.1.0/tests/test_sandbox_backend.py +93 -0
craik-0.1.0/tests/test_sandbox_policy_boundaries.py +262 -0
craik-0.1.0/tests/test_scheduled_automations.py +124 -0
craik-0.1.0/tests/test_schedules.py +70 -0
craik-0.1.0/tests/test_scratchpad.py +97 -0
craik-0.1.0/tests/test_secret_migration.py +181 -0
craik-0.1.0/tests/test_secrets.py +43 -0
craik-0.1.0/tests/test_side_effects.py +341 -0
craik-0.1.0/tests/test_skill_contexts.py +100 -0
craik-0.1.0/tests/test_skill_promotions.py +177 -0
craik-0.1.0/tests/test_skill_proposals.py +154 -0
craik-0.1.0/tests/test_skill_registries.py +127 -0
craik-0.1.0/tests/test_skill_replay.py +106 -0
craik-0.1.0/tests/test_skill_rollbacks.py +126 -0
craik-0.1.0/tests/test_skill_telemetry.py +128 -0
craik-0.1.0/tests/test_skills.py +62 -0
craik-0.1.0/tests/test_speech_to_text.py +181 -0
craik-0.1.0/tests/test_store.py +618 -0
craik-0.1.0/tests/test_text_to_speech.py +163 -0
craik-0.1.0/tests/test_trajectory_exports.py +229 -0
craik-0.1.0/tests/test_update_guidance.py +28 -0
craik-0.1.0/tests/test_visual_workspace.py +128 -0
craik-0.1.0/tests/test_voice_posture.py +124 -0
craik-0.1.0/tests/test_webhook_ingress.py +132 -0
craik-0.1.0/tests/test_work_graph_visual.py +110 -0
craik-0.1.0/tests/test_worker_results.py +64 -0
craik-0.1.0/tests/test_workload_identity.py +161 -0
craik-0.1.0/tests/test_workload_identity_scheme.py +119 -0
craik-0.1.0/uv.lock +414 -0

craik-0.1.0/.bandit-baseline.json ADDED Viewed

@@ -0,0 +1,2937 @@
+{
+  "errors": [],
+  "generated_at": "2026-05-18T11:33:21Z",
+  "metrics": {
+    "_totals": {
+      "CONFIDENCE.HIGH": 17,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 10,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 18,
+      "SEVERITY.MEDIUM": 9,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 25294,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/__init__.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 3,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/cli.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 196,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/cli_auth.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 365,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/cli_connect.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 40,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/cli_demos.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 121,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/cli_handoffs.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 121,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/cli_onboarding.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 54,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/cli_operations.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 422,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/cli_project.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 423,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/cli_receipts.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 50,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/cli_runs.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 270,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/contracts/__init__.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 149,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/contracts/models/__init__.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 10,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/contracts/models/base.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 311,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/contracts/models/core.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 251,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/contracts/models/handoffs.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 172,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/contracts/models/instructions.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 277,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/contracts/models/memory.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 1,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 1,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 500,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/contracts/models/review.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 343,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/contracts/models/runtime.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 331,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/contracts/models/skills.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 447,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/contracts/registry.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 164,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/contracts/runner_models.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 132,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/__init__.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 126,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/auth/__init__.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 40,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/auth/operator/__init__.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 35,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/auth/operator/cache_control.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 22,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/auth/operator/context.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 29,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/auth/operator/oidc.py": {
+      "CONFIDENCE.HIGH": 2,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 2,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 432,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/auth/operator/session.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 15,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/auth/operator/store.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 156,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/auth/pool.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 226,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/auth/profile.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 2,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 2,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 67,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/auth/sources/__init__.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 44,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/auth/sources/api_key.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 35,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/auth/sources/cli_bridge.py": {
+      "CONFIDENCE.HIGH": 2,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 3,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 5,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 135,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/auth/sources/factory.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 111,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/auth/sources/local_cli_oauth.py": {
+      "CONFIDENCE.HIGH": 1,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 1,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 212,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/auth/sources/oidc_exchange.py": {
+      "CONFIDENCE.HIGH": 1,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 2,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 2,
+      "SEVERITY.MEDIUM": 1,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 79,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/auth/sources/secret_ref.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 1,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 1,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 88,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/auth/sources/stigmem_ref.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 71,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/auth/store.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 254,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/auth/url_safety.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 18,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/auth/workload/__init__.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 17,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/auth/workload/oidc_federation.py": {
+      "CONFIDENCE.HIGH": 1,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 1,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 127,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/bridges/__init__.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 0,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/bridges/adjacent_runtime_bridge.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 112,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/bridges/multi_agent_workflow_bridge.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 122,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/channels/__init__.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 2,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/channels/allowlist.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 120,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/channels/identity.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 78,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/channels/messaging.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 168,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/channels/policy.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 128,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/channels/scheduled_automations.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 111,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/channels/schedules.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 83,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/channels/webhook_ingress.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 129,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/companions/__init__.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 0,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/companions/accessibility.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 56,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/companions/desktop_companion.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 93,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/companions/locale_i18n.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 139,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/companions/mobile_companion.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 98,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/companions/operator_artifact_views.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 167,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/companions/operator_views.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 421,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/companions/visual_workspace.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 87,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/companions/work_graph_visual.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 127,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/doctor.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 301,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/environment_receipts.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 106,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/gateway.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 106,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/gateway_receipts.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 84,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/github.py": {
+      "CONFIDENCE.HIGH": 1,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 1,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 225,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/memory/__init__.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 3,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/memory/contradictions.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 83,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/memory/diff.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 133,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/memory/freshness.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 60,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/memory/local_stores.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 135,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/memory/memory.py": {
+      "CONFIDENCE.HIGH": 1,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 1,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 330,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/memory/memory_errors.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 18,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/memory/memory_hygiene.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 55,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/memory/memory_proposals.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 100,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/memory/memory_review.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 82,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/memory/operator_memory_views.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 89,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/memory/preference_facts.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 58,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/paths.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 108,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/policy/__init__.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 3,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/policy/credential_policy.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 82,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/policy/intent_locks.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 76,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/policy/operator_policy.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 92,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/policy/policy.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 430,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/policy/policy_tests.py": {
+      "CONFIDENCE.HIGH": 2,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 2,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 324,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/policy/redaction.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 149,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/projects/__init__.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 0,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/projects/demos.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 432,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/projects/demos_provider.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 50,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/projects/git_commands.py": {
+      "CONFIDENCE.HIGH": 2,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 2,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 27,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/projects/import_dry_run.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 82,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/projects/instruction_sources.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 312,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/projects/migration_assessment.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 103,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/projects/migration_maps.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 41,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/projects/onboarding.py": {
+      "CONFIDENCE.HIGH": 1,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 1,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 257,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/projects/project_registry.py": {
+      "CONFIDENCE.HIGH": 1,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 1,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 112,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/projects/prompts.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 234,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/projects/public_docs.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 161,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/projects/secret_migration.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 1,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 1,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 129,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/projects/update_guidance.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 28,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/providers/__init__.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 0,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/providers/http_transport.py": {
+      "CONFIDENCE.HIGH": 1,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 1,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 133,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/providers/model_providers.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 337,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/providers/provider_budgets.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 63,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/providers/provider_certification.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 84,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/providers/provider_config.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 75,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/providers/provider_execution.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 289,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/providers/provider_failover.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 72,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/providers/provider_models.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 94,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/providers/provider_runner.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 317,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/providers/provider_runtime.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 411,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/providers/provider_runtime_support.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 361,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/providers/provider_transport.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 165,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/providers/provider_url_safety.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 27,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/reviewing/__init__.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 0,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/reviewing/critics.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 80,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/reviewing/debates.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 143,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/reviewing/delegations.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 54,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/reviewing/investigations.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 178,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/reviewing/reviews.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 94,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/runners/__init__.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 3,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/runners/claude_adapter.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 48,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/runners/codex_adapter.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 48,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/runners/gemini_adapter.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 48,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/runners/preview_adapter.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 234,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/runners/runner_metadata.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 61,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/runners/runners.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 307,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/sandbox/__init__.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 0,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/sandbox/browser_tool_boundary.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 127,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/sandbox/docker_sandbox_backend.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 108,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/sandbox/local_process_backend.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 84,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/sandbox/mcp_client.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 116,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/sandbox/mcp_export.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 70,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/sandbox/remote_shell_backend.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 157,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/secrets.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 38,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/side_effects.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 219,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/skills/__init__.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 0,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/skills/learning_receipts.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 110,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/skills/skill_promotions.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 119,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/skills/skill_proposals.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 93,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/skills/skill_replay.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 119,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/skills/skill_rollbacks.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 110,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/skills/skill_telemetry.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 100,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/skills/trajectory_exports.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 270,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/store/__init__.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 37,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/store/base.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 415,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/store/extensions.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 243,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/store/memory.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 93,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/store/profiles.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 86,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/store/work.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 193,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/store_kinds.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 65,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/voice/__init__.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 0,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/voice/multimodal_artifacts.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 134,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/voice/speech_to_text.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 136,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/voice/text_to_speech.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 127,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/voice/voice_posture.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 84,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/work/__init__.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 0,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/work/case_files.py": {
+      "CONFIDENCE.HIGH": 1,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 1,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 426,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/work/case_support/__init__.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 17,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/work/case_support/context.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 151,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/work/case_support/credential_risks.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 84,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/work/case_support/receipts.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 29,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/work/context_debt.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 188,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/work/exit_discipline.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 52,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/work/graph.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 314,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/work/handoffs.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 438,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/work/known_traps.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 52,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/work/loop.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 448,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/work/loop_support/__init__.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 1,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/work/loop_support/tool_dispatch.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 121,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/work/quality_scores.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 182,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/work/receipts.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 78,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/work/recovery.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 275,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/work/run_outputs.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 128,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/work/runs.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 119,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/work/scratchpad.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 39,
+      "nosec": 0,
+      "skipped_tests": 0
+    },
+    "src/craik/runtime/work/tasks.py": {
+      "CONFIDENCE.HIGH": 0,
+      "CONFIDENCE.LOW": 0,
+      "CONFIDENCE.MEDIUM": 0,
+      "CONFIDENCE.UNDEFINED": 0,
+      "SEVERITY.HIGH": 0,
+      "SEVERITY.LOW": 0,
+      "SEVERITY.MEDIUM": 0,
+      "SEVERITY.UNDEFINED": 0,
+      "loc": 41,
+      "nosec": 0,
+      "skipped_tests": 0
+    }
+  },
+  "results": [
+    {
+      "code": "129             raise ValueError(\"daemon gateway mode requires pid_file\")\n130         if self.bind_host in {\"0.0.0.0\", \"::\"} and not self.policy_envelope_id:\n131             raise ValueError(\"public gateway bind requires policy_envelope_id\")\n",
+      "col_offset": 30,
+      "end_col_offset": 39,
+      "filename": "src/craik/contracts/models/memory.py",
+      "issue_confidence": "MEDIUM",
+      "issue_cwe": {
+        "id": 605,
+        "link": "https://cwe.mitre.org/data/definitions/605.html"
+      },
+      "issue_severity": "MEDIUM",
+      "issue_text": "Possible binding to all interfaces.",
+      "line_number": 130,
+      "line_range": [
+        130
+      ],
+      "more_info": "https://bandit.readthedocs.io/en/1.8.3/plugins/b104_hardcoded_bind_all_interfaces.html",
+      "test_id": "B104",
+      "test_name": "hardcoded_bind_all_interfaces"
+    },
+    {
+      "code": "338         try:\n339             with request.urlopen(http_request, timeout=self.timeout_seconds) as response:\n340                 return _json_response(response.read()), response.headers\n",
+      "col_offset": 17,
+      "end_col_offset": 76,
+      "filename": "src/craik/runtime/auth/operator/oidc.py",
+      "issue_confidence": "HIGH",
+      "issue_cwe": {
+        "id": 22,
+        "link": "https://cwe.mitre.org/data/definitions/22.html"
+      },
+      "issue_severity": "MEDIUM",
+      "issue_text": "Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.",
+      "line_number": 339,
+      "line_range": [
+        339
+      ],
+      "more_info": "https://bandit.readthedocs.io/en/1.8.3/blacklists/blacklist_calls.html#b310-urllib-urlopen",
+      "test_id": "B310",
+      "test_name": "blacklist"
+    },
+    {
+      "code": "358         try:\n359             with request.urlopen(http_request, timeout=self.timeout_seconds) as response:\n360                 return _json_response(response.read())\n",
+      "col_offset": 17,
+      "end_col_offset": 76,
+      "filename": "src/craik/runtime/auth/operator/oidc.py",
+      "issue_confidence": "HIGH",
+      "issue_cwe": {
+        "id": 22,
+        "link": "https://cwe.mitre.org/data/definitions/22.html"
+      },
+      "issue_severity": "MEDIUM",
+      "issue_text": "Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.",
+      "line_number": 359,
+      "line_range": [
+        359
+      ],
+      "more_info": "https://bandit.readthedocs.io/en/1.8.3/blacklists/blacklist_calls.html#b310-urllib-urlopen",
+      "test_id": "B310",
+      "test_name": "blacklist"
+    },
+    {
+      "code": "21     API_KEY = \"api-key\"\n22     OAUTH_TOKEN = \"oauth-token\"\n23     SECRET_REF = \"secret-ref\"\n",
+      "col_offset": 18,
+      "end_col_offset": 31,
+      "filename": "src/craik/runtime/auth/profile.py",
+      "issue_confidence": "MEDIUM",
+      "issue_cwe": {
+        "id": 259,
+        "link": "https://cwe.mitre.org/data/definitions/259.html"
+      },
+      "issue_severity": "LOW",
+      "issue_text": "Possible hardcoded password: 'oauth-token'",
+      "line_number": 22,
+      "line_range": [
+        22
+      ],
+      "more_info": "https://bandit.readthedocs.io/en/1.8.3/plugins/b105_hardcoded_password_string.html",
+      "test_id": "B105",
+      "test_name": "hardcoded_password_string"
+    },
+    {
+      "code": "22     OAUTH_TOKEN = \"oauth-token\"\n23     SECRET_REF = \"secret-ref\"\n24     STIGMEM_REF = \"stigmem-ref\"\n",
+      "col_offset": 17,
+      "end_col_offset": 29,
+      "filename": "src/craik/runtime/auth/profile.py",
+      "issue_confidence": "MEDIUM",
+      "issue_cwe": {
+        "id": 259,
+        "link": "https://cwe.mitre.org/data/definitions/259.html"
+      },
+      "issue_severity": "LOW",
+      "issue_text": "Possible hardcoded password: 'secret-ref'",
+      "line_number": 23,
+      "line_range": [
+        23
+      ],
+      "more_info": "https://bandit.readthedocs.io/en/1.8.3/plugins/b105_hardcoded_password_string.html",
+      "test_id": "B105",
+      "test_name": "hardcoded_password_string"
+    },
+    {
+      "code": "5 import json\n6 import subprocess\n7 import threading\n",
+      "col_offset": 0,
+      "end_col_offset": 17,
+      "filename": "src/craik/runtime/auth/sources/cli_bridge.py",
+      "issue_confidence": "HIGH",
+      "issue_cwe": {
+        "id": 78,
+        "link": "https://cwe.mitre.org/data/definitions/78.html"
+      },
+      "issue_severity": "LOW",
+      "issue_text": "Consider possible security implications associated with the subprocess module.",
+      "line_number": 6,
+      "line_range": [
+        6
+      ],
+      "more_info": "https://bandit.readthedocs.io/en/1.8.3/blacklists/blacklist_imports.html#b404-import-subprocess",
+      "test_id": "B404",
+      "test_name": "blacklist"
+    },
+    {
+      "code": "53     def _resolve_token(self) -> str:\n54         if self.token_extractor == \"credentials_file\":\n55             if self.credentials_file_path is None:\n",
+      "col_offset": 35,
+      "end_col_offset": 53,
+      "filename": "src/craik/runtime/auth/sources/cli_bridge.py",
+      "issue_confidence": "MEDIUM",
+      "issue_cwe": {
+        "id": 259,
+        "link": "https://cwe.mitre.org/data/definitions/259.html"
+      },
+      "issue_severity": "LOW",
+      "issue_text": "Possible hardcoded password: 'credentials_file'",
+      "line_number": 54,
+      "line_range": [
+        54
+      ],
+      "more_info": "https://bandit.readthedocs.io/en/1.8.3/plugins/b105_hardcoded_password_string.html",
+      "test_id": "B105",
+      "test_name": "hardcoded_password_string"
+    },
+    {
+      "code": "60         stdout = self._command_stdout()\n61         if self.token_extractor == \"stdout_line\":\n62             token = next((line.strip() for line in stdout.splitlines() if line.strip()), \"\")\n",
+      "col_offset": 35,
+      "end_col_offset": 48,
+      "filename": "src/craik/runtime/auth/sources/cli_bridge.py",
+      "issue_confidence": "MEDIUM",
+      "issue_cwe": {
+        "id": 259,
+        "link": "https://cwe.mitre.org/data/definitions/259.html"
+      },
+      "issue_severity": "LOW",
+      "issue_text": "Possible hardcoded password: 'stdout_line'",
+      "line_number": 61,
+      "line_range": [
+        61
+      ],
+      "more_info": "https://bandit.readthedocs.io/en/1.8.3/plugins/b105_hardcoded_password_string.html",
+      "test_id": "B105",
+      "test_name": "hardcoded_password_string"
+    },
+    {
+      "code": "65             return token\n66         if self.token_extractor == \"stdout_json\":\n67             try:\n",
+      "col_offset": 35,
+      "end_col_offset": 48,
+      "filename": "src/craik/runtime/auth/sources/cli_bridge.py",
+      "issue_confidence": "MEDIUM",
+      "issue_cwe": {
+        "id": 259,
+        "link": "https://cwe.mitre.org/data/definitions/259.html"
+      },
+      "issue_severity": "LOW",
+      "issue_text": "Possible hardcoded password: 'stdout_json'",
+      "line_number": 66,
+      "line_range": [
+        66
+      ],
+      "more_info": "https://bandit.readthedocs.io/en/1.8.3/plugins/b105_hardcoded_password_string.html",
+      "test_id": "B105",
+      "test_name": "hardcoded_password_string"
+    },
+    {
+      "code": "79         try:\n80             process = subprocess.Popen(\n81                 list(self.command),\n82                 stdout=subprocess.PIPE,\n83                 stderr=subprocess.DEVNULL,\n84                 text=False,\n85             )\n86         except OSError as exc:\n",
+      "col_offset": 22,
+      "end_col_offset": 13,
+      "filename": "src/craik/runtime/auth/sources/cli_bridge.py",
+      "issue_confidence": "HIGH",
+      "issue_cwe": {
+        "id": 78,
+        "link": "https://cwe.mitre.org/data/definitions/78.html"
+      },
+      "issue_severity": "LOW",
+      "issue_text": "subprocess call - check for execution of untrusted input.",
+      "line_number": 80,
+      "line_range": [
+        80,
+        81,
+        82,
+        83,
+        84,
+        85
+      ],
+      "more_info": "https://bandit.readthedocs.io/en/1.8.3/plugins/b603_subprocess_without_shell_equals_true.html",
+      "test_id": "B603",
+      "test_name": "subprocess_without_shell_equals_true"
+    },
+    {
+      "code": "116         try:\n117             with request.urlopen(http_request, timeout=self.timeout_seconds) as response:\n118                 refreshed = json.loads(response.read().decode(\"utf-8\"))\n",
+      "col_offset": 17,
+      "end_col_offset": 76,
+      "filename": "src/craik/runtime/auth/sources/local_cli_oauth.py",
+      "issue_confidence": "HIGH",
+      "issue_cwe": {
+        "id": 22,
+        "link": "https://cwe.mitre.org/data/definitions/22.html"
+      },
+      "issue_severity": "MEDIUM",
+      "issue_text": "Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.",
+      "line_number": 117,
+      "line_range": [
+        117
+      ],
+      "more_info": "https://bandit.readthedocs.io/en/1.8.3/blacklists/blacklist_calls.html#b310-urllib-urlopen",
+      "test_id": "B310",
+      "test_name": "blacklist"
+    },
+    {
+      "code": "13 \n14 TOKEN_EXCHANGE_GRANT_TYPE = \"urn:ietf:params:oauth:grant-type:token-exchange\"\n15 OIDC_SUBJECT_TOKEN_TYPE = \"urn:ietf:params:oauth:token-type:id_token\"\n",
+      "col_offset": 28,
+      "end_col_offset": 77,
+      "filename": "src/craik/runtime/auth/sources/oidc_exchange.py",
+      "issue_confidence": "MEDIUM",
+      "issue_cwe": {
+        "id": 259,
+        "link": "https://cwe.mitre.org/data/definitions/259.html"
+      },
+      "issue_severity": "LOW",
+      "issue_text": "Possible hardcoded password: 'urn:ietf:params:oauth:grant-type:token-exchange'",
+      "line_number": 14,
+      "line_range": [
+        14
+      ],
+      "more_info": "https://bandit.readthedocs.io/en/1.8.3/plugins/b105_hardcoded_password_string.html",
+      "test_id": "B105",
+      "test_name": "hardcoded_password_string"
+    },
+    {
+      "code": "14 TOKEN_EXCHANGE_GRANT_TYPE = \"urn:ietf:params:oauth:grant-type:token-exchange\"\n15 OIDC_SUBJECT_TOKEN_TYPE = \"urn:ietf:params:oauth:token-type:id_token\"\n16 \n",
+      "col_offset": 26,
+      "end_col_offset": 69,
+      "filename": "src/craik/runtime/auth/sources/oidc_exchange.py",
+      "issue_confidence": "MEDIUM",
+      "issue_cwe": {
+        "id": 259,
+        "link": "https://cwe.mitre.org/data/definitions/259.html"
+      },
+      "issue_severity": "LOW",
+      "issue_text": "Possible hardcoded password: 'urn:ietf:params:oauth:token-type:id_token'",
+      "line_number": 15,
+      "line_range": [
+        15
+      ],
+      "more_info": "https://bandit.readthedocs.io/en/1.8.3/plugins/b105_hardcoded_password_string.html",
+      "test_id": "B105",
+      "test_name": "hardcoded_password_string"
+    },
+    {
+      "code": "73         try:\n74             with request.urlopen(http_request, timeout=self.timeout_seconds) as response:\n75                 response_payload = json.loads(response.read().decode(\"utf-8\"))\n",
+      "col_offset": 17,
+      "end_col_offset": 76,
+      "filename": "src/craik/runtime/auth/sources/oidc_exchange.py",
+      "issue_confidence": "HIGH",
+      "issue_cwe": {
+        "id": 22,
+        "link": "https://cwe.mitre.org/data/definitions/22.html"
+      },
+      "issue_severity": "MEDIUM",
+      "issue_text": "Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.",
+      "line_number": 74,
+      "line_range": [
+        74
+      ],
+      "more_info": "https://bandit.readthedocs.io/en/1.8.3/blacklists/blacklist_calls.html#b310-urllib-urlopen",
+      "test_id": "B310",
+      "test_name": "blacklist"
+    },
+    {
+      "code": "25 \n26 SECRET_REFERENCE_ERROR = \"secret reference could not be resolved\"\n27 \n",
+      "col_offset": 25,
+      "end_col_offset": 65,
+      "filename": "src/craik/runtime/auth/sources/secret_ref.py",
+      "issue_confidence": "MEDIUM",
+      "issue_cwe": {
+        "id": 259,
+        "link": "https://cwe.mitre.org/data/definitions/259.html"
+      },
+      "issue_severity": "LOW",
+      "issue_text": "Possible hardcoded password: 'secret reference could not be resolved'",
+      "line_number": 26,
+      "line_range": [
+        26
+      ],
+      "more_info": "https://bandit.readthedocs.io/en/1.8.3/plugins/b105_hardcoded_password_string.html",
+      "test_id": "B105",
+      "test_name": "hardcoded_password_string"
+    },
+    {
+      "code": "62         try:\n63             with request.urlopen(http_request, timeout=self.timeout_seconds) as response:\n64                 payload = json.loads(response.read().decode(\"utf-8\"))\n",
+      "col_offset": 17,
+      "end_col_offset": 76,
+      "filename": "src/craik/runtime/auth/workload/oidc_federation.py",
+      "issue_confidence": "HIGH",
+      "issue_cwe": {
+        "id": 22,
+        "link": "https://cwe.mitre.org/data/definitions/22.html"
+      },
+      "issue_severity": "MEDIUM",
+      "issue_text": "Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.",
+      "line_number": 63,
+      "line_range": [
+        63
+      ],
+      "more_info": "https://bandit.readthedocs.io/en/1.8.3/blacklists/blacklist_calls.html#b310-urllib-urlopen",
+      "test_id": "B310",
+      "test_name": "blacklist"
+    },
+    {
+      "code": "133         try:\n134             with request.urlopen(http_request, timeout=self._config.timeout_seconds) as response:\n135                 data = response.read()\n",
+      "col_offset": 17,
+      "end_col_offset": 84,
+      "filename": "src/craik/runtime/github.py",
+      "issue_confidence": "HIGH",
+      "issue_cwe": {
+        "id": 22,
+        "link": "https://cwe.mitre.org/data/definitions/22.html"
+      },
+      "issue_severity": "MEDIUM",
+      "issue_text": "Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.",
+      "line_number": 134,
+      "line_range": [
+        134
+      ],
+      "more_info": "https://bandit.readthedocs.io/en/1.8.3/blacklists/blacklist_calls.html#b310-urllib-urlopen",
+      "test_id": "B310",
+      "test_name": "blacklist"
+    },
+    {
+      "code": "198         try:\n199             with request.urlopen(http_request, timeout=self._config.timeout_seconds) as response:\n200                 data = response.read()\n",
+      "col_offset": 17,
+      "end_col_offset": 84,
+      "filename": "src/craik/runtime/memory/memory.py",
+      "issue_confidence": "HIGH",
+      "issue_cwe": {
+        "id": 22,
+        "link": "https://cwe.mitre.org/data/definitions/22.html"
+      },
+      "issue_severity": "MEDIUM",
+      "issue_text": "Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.",
+      "line_number": 199,
+      "line_range": [
+        199
+      ],
+      "more_info": "https://bandit.readthedocs.io/en/1.8.3/blacklists/blacklist_calls.html#b310-urllib-urlopen",
+      "test_id": "B310",
+      "test_name": "blacklist"
+    },
+    {
+      "code": "5 import os\n6 import subprocess\n7 from collections.abc import Callable\n",
+      "col_offset": 0,
+      "end_col_offset": 17,
+      "filename": "src/craik/runtime/policy/policy_tests.py",
+      "issue_confidence": "HIGH",
+      "issue_cwe": {
+        "id": 78,
+        "link": "https://cwe.mitre.org/data/definitions/78.html"
+      },
+      "issue_severity": "LOW",
+      "issue_text": "Consider possible security implications associated with the subprocess module.",
+      "line_number": 6,
+      "line_range": [
+        6
+      ],
+      "more_info": "https://bandit.readthedocs.io/en/1.8.3/blacklists/blacklist_imports.html#b404-import-subprocess",
+      "test_id": "B404",
+      "test_name": "blacklist"
+    },
+    {
+      "code": "339 def _run_git(repo: Path, *args: str) -> None:\n340     subprocess.run(\n341         (\"git\", *args),\n342         cwd=repo,\n343         check=True,\n344         capture_output=True,\n345         text=True,\n346         env={\n347             **os.environ,\n348             \"GIT_AUTHOR_EMAIL\": \"policy@example.invalid\",\n349             \"GIT_AUTHOR_NAME\": \"Craik Policy Test\",\n350             \"GIT_COMMITTER_EMAIL\": \"policy@example.invalid\",\n351             \"GIT_COMMITTER_NAME\": \"Craik Policy Test\",\n352         },\n353     )\n",
+      "col_offset": 4,
+      "end_col_offset": 5,
+      "filename": "src/craik/runtime/policy/policy_tests.py",
+      "issue_confidence": "HIGH",
+      "issue_cwe": {
+        "id": 78,
+        "link": "https://cwe.mitre.org/data/definitions/78.html"
+      },
+      "issue_severity": "LOW",
+      "issue_text": "subprocess call - check for execution of untrusted input.",
+      "line_number": 340,
+      "line_range": [
+        340,
+        341,
+        342,
+        343,
+        344,
+        345,
+        346,
+        347,
+        348,
+        349,
+        350,
+        351,
+        352,
+        353
+      ],
+      "more_info": "https://bandit.readthedocs.io/en/1.8.3/plugins/b603_subprocess_without_shell_equals_true.html",
+      "test_id": "B603",
+      "test_name": "subprocess_without_shell_equals_true"
+    },
+    {
+      "code": "4 \n5 import subprocess\n6 from pathlib import Path\n",
+      "col_offset": 0,
+      "end_col_offset": 17,
+      "filename": "src/craik/runtime/projects/git_commands.py",
+      "issue_confidence": "HIGH",
+      "issue_cwe": {
+        "id": 78,
+        "link": "https://cwe.mitre.org/data/definitions/78.html"
+      },
+      "issue_severity": "LOW",
+      "issue_text": "Consider possible security implications associated with the subprocess module.",
+      "line_number": 5,
+      "line_range": [
+        5
+      ],
+      "more_info": "https://bandit.readthedocs.io/en/1.8.3/blacklists/blacklist_imports.html#b404-import-subprocess",
+      "test_id": "B404",
+      "test_name": "blacklist"
+    },
+    {
+      "code": "27         raise GitCommandDeniedError(\"git command is not approved for project inspection\")\n28     return subprocess.run(\n29         (\"git\", \"-C\", str(cwd), *args),\n30         check=False,\n31         text=True,\n32         capture_output=True,\n33     )\n34 \n",
+      "col_offset": 11,
+      "end_col_offset": 5,
+      "filename": "src/craik/runtime/projects/git_commands.py",
+      "issue_confidence": "HIGH",
+      "issue_cwe": {
+        "id": 78,
+        "link": "https://cwe.mitre.org/data/definitions/78.html"
+      },
+      "issue_severity": "LOW",
+      "issue_text": "subprocess call - check for execution of untrusted input.",
+      "line_number": 28,
+      "line_range": [
+        28,
+        29,
+        30,
+        31,
+        32,
+        33
+      ],
+      "more_info": "https://bandit.readthedocs.io/en/1.8.3/plugins/b603_subprocess_without_shell_equals_true.html",
+      "test_id": "B603",
+      "test_name": "subprocess_without_shell_equals_true"
+    },
+    {
+      "code": "5 import os\n6 import subprocess\n7 from dataclasses import dataclass\n",
+      "col_offset": 0,
+      "end_col_offset": 17,
+      "filename": "src/craik/runtime/projects/onboarding.py",
+      "issue_confidence": "HIGH",
+      "issue_cwe": {
+        "id": 78,
+        "link": "https://cwe.mitre.org/data/definitions/78.html"
+      },
+      "issue_severity": "LOW",
+      "issue_text": "Consider possible security implications associated with the subprocess module.",
+      "line_number": 6,
+      "line_range": [
+        6
+      ],
+      "more_info": "https://bandit.readthedocs.io/en/1.8.3/blacklists/blacklist_imports.html#b404-import-subprocess",
+      "test_id": "B404",
+      "test_name": "blacklist"
+    },
+    {
+      "code": "5 import re\n6 import subprocess\n7 from pathlib import Path\n",
+      "col_offset": 0,
+      "end_col_offset": 17,
+      "filename": "src/craik/runtime/projects/project_registry.py",
+      "issue_confidence": "HIGH",
+      "issue_cwe": {
+        "id": 78,
+        "link": "https://cwe.mitre.org/data/definitions/78.html"
+      },
+      "issue_severity": "LOW",
+      "issue_text": "Consider possible security implications associated with the subprocess module.",
+      "line_number": 6,
+      "line_range": [
+        6
+      ],
+      "more_info": "https://bandit.readthedocs.io/en/1.8.3/blacklists/blacklist_imports.html#b404-import-subprocess",
+      "test_id": "B404",
+      "test_name": "blacklist"
+    },
+    {
+      "code": "63             raise ValueError(\"secret migration policy must prohibit secret value copying\")\n64         if self.default_secret_handling != \"block\":\n65             raise ValueError(\"unknown secret fields must be blocked by default\")\n",
+      "col_offset": 43,
+      "end_col_offset": 50,
+      "filename": "src/craik/runtime/projects/secret_migration.py",
+      "issue_confidence": "MEDIUM",
+      "issue_cwe": {
+        "id": 259,
+        "link": "https://cwe.mitre.org/data/definitions/259.html"
+      },
+      "issue_severity": "LOW",
+      "issue_text": "Possible hardcoded password: 'block'",
+      "line_number": 64,
+      "line_range": [
+        64
+      ],
+      "more_info": "https://bandit.readthedocs.io/en/1.8.3/plugins/b105_hardcoded_password_string.html",
+      "test_id": "B105",
+      "test_name": "hardcoded_password_string"
+    },
+    {
+      "code": "69         try:\n70             with request.urlopen(http_request, timeout=self._timeout_seconds) as response:\n71                 if stream:\n",
+      "col_offset": 17,
+      "end_col_offset": 77,
+      "filename": "src/craik/runtime/providers/http_transport.py",
+      "issue_confidence": "HIGH",
+      "issue_cwe": {
+        "id": 22,
+        "link": "https://cwe.mitre.org/data/definitions/22.html"
+      },
+      "issue_severity": "MEDIUM",
+      "issue_text": "Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.",
+      "line_number": 70,
+      "line_range": [
+        70
+      ],
+      "more_info": "https://bandit.readthedocs.io/en/1.8.3/blacklists/blacklist_calls.html#b310-urllib-urlopen",
+      "test_id": "B310",
+      "test_name": "blacklist"
+    },
+    {
+      "code": "6 import os\n7 import subprocess\n8 from dataclasses import dataclass\n",
+      "col_offset": 0,
+      "end_col_offset": 17,
+      "filename": "src/craik/runtime/work/case_files.py",
+      "issue_confidence": "HIGH",
+      "issue_cwe": {
+        "id": 78,
+        "link": "https://cwe.mitre.org/data/definitions/78.html"
+      },
+      "issue_severity": "LOW",
+      "issue_text": "Consider possible security implications associated with the subprocess module.",
+      "line_number": 7,
+      "line_range": [
+        7
+      ],
+      "more_info": "https://bandit.readthedocs.io/en/1.8.3/blacklists/blacklist_imports.html#b404-import-subprocess",
+      "test_id": "B404",
+      "test_name": "blacklist"
+    }
+  ]
+}