{ "schema_version": "stem-ai-local-cli-result-v1.6", "stem_ai_version": "1.7.8", "generated_at_local": "2026-05-21", "execution_mode": "LOCAL_ANALYSIS", "target": { "name": "Runchuan-BU/BioClaw", "local_path": "D:\\Sanctum\\Extra Repo\\BioClaw", "remote": "https://github.com/Runchuan-BU/BioClaw", "branch": "main", "commit": "faae6a2778e992b1cc6a4b1639e530a147d8b463", "file_count": 274 }, "classification": { "clinical_adjacent": true, "ca_severity": "CA-INDIRECT", "ca_taxonomy_version": "ca-taxonomy-v1", "ca_taxonomy_source": "runtime_regex_hardcoded_in_scanner_py", "t0_hard_floor": false, "score_cap": 69, "has_explicit_clinical_boundary": false }, "score": { "stage_1_readme_intent": 70, "stage_2_cross_platform": "not_applicable_in_LOCAL_ANALYSIS", "stage_2_repo_local_consistency": 50, "stage_2_lane": "STAGE_2R_REPO_LOCAL_CONSISTENCY", "stage_3_code_bio": 54, "weights": { "stage_1": 0.4, "stage_2": 0.2, "stage_3": 0.4 }, "risk_penalty": 0, "raw_score_before_floor": 60, "final_score": 60, "formal_tier": "T2 Caution", "use_scope": "Research reference and supervised non-clinical technical review only." }, "stage_2r_rubric": { "baseline": { "score": 60, "evidence": "Non-nascent local repository baseline.", "detector_id": "stage2r_baseline", "decision_basis": "repository has sufficient local structure to enter repo-local consistency review" }, "R2R_3_readme_test_ci_alignment": { "score": 10, "evidence": "Test/CI surfaces are present and locally consistent.", "detector_id": "R2R_3_readme_test_ci_alignment", "decision_basis": "workflow/test support terms found across README and local support surfaces" }, "R2R_D2_missing_clinical_use_boundary": { "score": -20, "evidence": "Clinical-adjacent surfaces exist without an explicit non-diagnostic/non-clinical boundary.", "detector_id": "R2R_D2_missing_clinical_use_boundary", "decision_basis": "clinical_adjacent=True and explicit non-clinical boundary was not detected" }, "calculation": "60 plus local consistency additions/deductions = 50", "stage_2r_score": 50, "verdict": "Local Contradiction / Insufficient Consistency" }, "stage_1_rubric": { "baseline": { "score": 60, "evidence": "Non-nascent README evidence baseline." }, "S1_domain_readme": { "score": 10, "evidence": "README exposes bio/medical domain vocabulary." }, "R2_regulatory_framework": { "score": -5, "evidence": "CA-INDIRECT surface lacks regulatory or governance framework language." }, "R3_clinical_disclaimer": { "score": -5, "evidence": "CA-INDIRECT surface lacks explicit non-clinical or non-diagnostic boundary." }, "R4_demographic_bias_boundary": { "score": 10, "evidence": "Demographic, subgroup, fairness, bias, or validation-cohort language detected." }, "calculation": "60 plus Stage 1 evidence additions/deductions = 70", "stage_1_score": 70 }, "stage_3_rubric": { "T1_CI_CD": { "score": 15, "max": 15, "evidence": "Workflow files detected.", "detector_id": "S3_T1_workflow_files", "decision_basis": "workflow files present under .github/workflows/" }, "T2_domain_tests": { "score": 0, "max": 15, "evidence": "No tests detected.", "detector_id": "S3_T2_domain_tests", "decision_basis": "no tests surface detected" }, "T3_changelog_release_hygiene": { "score": 0, "max": 15, "evidence": "No changelog detected.", "detector_id": "S3_T3_changelog_release_hygiene", "decision_basis": "CHANGELOG/NEWS presence plus bug-fix or patch-entry detection" }, "B1_data_provenance_controls": { "score": 15, "max": 15, "evidence": "Dependency manifest detected with data source, IRB, or dataset citation language.", "detector_id": "S3_B1_dependency_manifest", "decision_basis": "dependency or lock manifest presence plus data-source, dataset, or IRB language review" }, "B2_bias_limitations": { "score": 8, "max": 15, "evidence": "Structured bias/limitations language detected; no quantitative measurement evidence found.", "detector_id": "S3_B2_bias_limitations", "decision_basis": "bias/limitations vocabulary with optional measurement-evidence escalation" }, "B3_coi_funding": { "score": 5, "max": 5, "evidence": "COI, funding, sponsor, or acknowledgement language detected.", "detector_id": "S3_B3_coi_funding", "decision_basis": "COI/funding/sponsor language review across README, docs, FUNDING, CITATION, and AUTHORS surfaces" }, "stage_3_raw_total": { "score": 43, "max": 80, "evidence": "Raw rubric total before normalization to 100." } }, "replication_score": 35, "replication_tier": "R1", "stage_4_rubric": { "S4_container_environment": { "score": 0, "max": 10, "evidence": "No evidence detected for S4_container_environment." }, "S4_make_reproduce_target": { "score": 0, "max": 10, "evidence": "No Makefile detected." }, "S4_environment_lock_evidence": { "score": 10, "max": 10, "evidence": "Environment, dependency, or lock manifest detected." }, "S4_exact_dependency_pins_or_hashes": { "score": 10, "max": 10, "evidence": "Exact dependency pin or hash evidence detected." }, "S4_readme_reproducibility_section": { "score": 0, "max": 10, "evidence": "README exists but no reproducibility or replication section heading was detected." }, "S4_checksum_files": { "score": 0, "max": 10, "evidence": "No evidence detected for S4_checksum_files." }, "S4_dataset_url": { "score": 0, "max": 10, "evidence": "Documentation exists but no dataset URL or data source URL was detected." }, "S4_model_weight_url_or_checksum": { "score": 10, "max": 10, "evidence": "Model artifact URL or checksum evidence detected." }, "S4_citation_cff": { "score": 0, "max": 5, "evidence": "No evidence detected for S4_citation_cff." }, "S4_license_restriction": { "score": 0, "max": 0, "evidence": "No license/use restriction language detected." }, "S4_cli_entrypoint": { "score": 5, "max": 5, "evidence": "CLI entry point or argparse interface detected." }, "S4_seed_setting": { "score": 0, "max": 5, "evidence": "No deterministic seed setting detected." }, "S4_runnable_examples": { "score": 0, "max": 5, "evidence": "No evidence detected for S4_runnable_examples." }, "stage_4_raw_total": { "score": 35, "max": 100, "evidence": "Raw Stage 4 rubric total. Stage 4 is reported separately and does not alter final score." } }, "code_integrity": { "C1_hardcoded_credentials": { "status": "PASS", "evidence": [ "No direct credential patterns detected by local CLI scan." ] }, "C2_dependency_pinning": { "status": "PASS", "evidence": [ "Dependency manifest appears pinned or not present." ] }, "C3_dead_or_deprecated_patient_adjacent_paths": { "status": "PASS", "evidence": [ "No deprecated patient-adjacent metadata patterns detected." ] }, "C4_exception_handling_clinical_adjacent_paths": { "status": "PASS", "evidence": [ "No executable fail-open exception handler detected." ] }, "C5_compliance_boundary_integrity": { "status": "WARN", "evidence": [ "Clinical-adjacent surfaces exist without an explicit non-diagnostic/non-clinical boundary." ] }, "C6_mock_auth_or_fail_open_boundary": { "status": "PASS", "evidence": [ "No mock-auth or fail-open local-boundary warning detected in reviewed sources." ] } }, "code_contract": { "CC1_clinical_zero_default": { "count": 0, "status": "PASS" }, "CC2_api_contract": { "count": 0, "status": "PASS" }, "CC3_shallow_validator": { "count": 0, "status": "PASS" } }, "airi_risk_coverage": { "airi_version": "V4_03", "airi_source": "https://airisk.mit.edu/ | The AI Risk Repository | license=MIT", "airi_registry_version": "stem-ai-airi-registry-v1", "airi_bundle_version": "stem-ai-airi-runtime-bundle-v1", "airi_mapping_version": "stem-ai-airi-detector-mapping-v1", "airi_bundle_scope": "curated_medical_clinical_subset", "airi_upstream_snapshot_date": "2026-04-23", "airi_upstream_license": "MIT", "airi_attribution_note": "Derived from The AI Risk Repository V4_03. Original source remains MIT-licensed and must be attributed in README, docs, runtime artifacts, and local registry metadata.", "total_risks_in_registry": 1595, "total_risks_in_bundle": 184, "total_risks_in_detector_scope": 32, "detectors_triggered": [ "C5_compliance_boundary_integrity" ], "covered_risks": [ { "id": "24.01.03", "title": "Safe exploration problem with widely deployed AI assistants", "subdomain_id": "7.3", "subdomain_label": "Lack of capability or robustness", "causal_timing": "Post-deployment", "covered_by": [ "C5_compliance_boundary_integrity" ], "mapping_details": [ { "detector_id": "C5_compliance_boundary_integrity", "mapping_justification": "Weak compliance and clinical-boundary integrity can cause users to over-trust unsafe exploration in clinical-adjacent contexts.", "trigger_reason": "Clinical-adjacent surfaces exist without an explicit non-diagnostic/non-clinical boundary." } ] }, { "id": "69.01.00", "title": "False information", "subdomain_id": "3.1", "subdomain_label": "False or misleading information", "causal_timing": "Other", "covered_by": [ "C5_compliance_boundary_integrity" ], "mapping_details": [ { "detector_id": "C5_compliance_boundary_integrity", "mapping_justification": "Unsupported legal or compliance boundary language can mislead reviewers about operational safety and permissible use.", "trigger_reason": "Clinical-adjacent surfaces exist without an explicit non-diagnostic/non-clinical boundary." } ] } ], "covered_count": 2, "coverage_rate": 0.062, "known_gaps": [ { "id": "65.03.03", "title": "Reidentification", "subdomain_id": "2.1", "gap_scope": "in_runtime_bundle", "note": "CC-3 catches shallow validators; dedicated reidentify() API exposure check (CC-4) not yet implemented." }, { "id": "70.02.02", "title": "Misinformation \u2014 hallucination of clinical knowledge", "subdomain_id": "3.1", "gap_scope": "in_runtime_bundle", "note": "CC-1 catches threshold=0.0 default; actual output-level hallucination rate requires Layer 3 dynamic testing." }, { "id": "39.25.00", "title": "Verifiability \u2014 black-box AI in medical healthcare", "subdomain_id": "7.4", "gap_scope": "in_runtime_bundle", "note": "B2 detects surface language only; Model Card / interpretability artifact presence not yet checked." }, { "id": "11.02.00", "title": "Allocative Harms \u2014 withheld resources in healthcare", "subdomain_id": "1.1", "gap_scope": "outside_runtime_bundle_reference", "note": "Subgroup performance disparities require dynamic evaluation; outside static scan scope." }, { "id": "72.04.02", "title": "Market Concentration \u2014 healthcare single-point failures", "subdomain_id": "6.1", "gap_scope": "outside_runtime_bundle_reference", "note": "Systemic risk beyond single-repository scope." } ], "known_gaps_in_bundle": [ { "id": "65.03.03", "title": "Reidentification", "subdomain_id": "2.1", "gap_scope": "in_runtime_bundle", "note": "CC-3 catches shallow validators; dedicated reidentify() API exposure check (CC-4) not yet implemented." }, { "id": "70.02.02", "title": "Misinformation \u2014 hallucination of clinical knowledge", "subdomain_id": "3.1", "gap_scope": "in_runtime_bundle", "note": "CC-1 catches threshold=0.0 default; actual output-level hallucination rate requires Layer 3 dynamic testing." }, { "id": "39.25.00", "title": "Verifiability \u2014 black-box AI in medical healthcare", "subdomain_id": "7.4", "gap_scope": "in_runtime_bundle", "note": "B2 detects surface language only; Model Card / interpretability artifact presence not yet checked." } ], "known_gaps_outside_bundle": [ { "id": "11.02.00", "title": "Allocative Harms \u2014 withheld resources in healthcare", "subdomain_id": "1.1", "gap_scope": "outside_runtime_bundle_reference", "note": "Subgroup performance disparities require dynamic evaluation; outside static scan scope." }, { "id": "72.04.02", "title": "Market Concentration \u2014 healthcare single-point failures", "subdomain_id": "6.1", "gap_scope": "outside_runtime_bundle_reference", "note": "Systemic risk beyond single-repository scope." } ] }, "evidence_ledger": [ { "finding_id": "S1_readme_bio_terms:README.md:459:001", "detector": "S1_readme_bio_terms", "detector_version": "1.7.8", "pattern_id": "bio_terms_v1", "status": "detected", "evidence_status": "confirmed_present", "confidence": "high", "severity": "info", "file": "README.md", "line": 459, "snippet": "| **BEDTools** | Genome arithmetic and interval manipulation |", "match_type": "regex", "explanation": "README exposes bio/medical vocabulary.", "metadata": { "match": "Genome" } }, { "finding_id": "S1_readme_bio_terms:README.md:467:002", "detector": "S1_readme_bio_terms", "detector_version": "1.7.8", "pattern_id": "bio_terms_v1", "status": "detected", "evidence_status": "confirmed_present", "confidence": "high", "severity": "info", "file": "README.md", "line": 467, "snippet": "| **BCFtools** | Variant calling and VCF/BCF manipulation |", "match_type": "regex", "explanation": "README exposes bio/medical vocabulary.", "metadata": { "match": "Variant" } }, { "finding_id": "S1_clinical_boundary:.:0:001", "detector": "S1_clinical_boundary", "detector_version": "1.7.8", "pattern_id": "clinical_boundary_v1", "status": "not_detected", "evidence_status": "not_found_in_reviewed_sources", "confidence": "medium", "severity": "info", "file": ".", "line": 0, "snippet": "", "match_type": "regex", "explanation": "No evidence detected for S1_clinical_boundary." }, { "finding_id": "S1_H1_clinical_certainty_hype:.:0:001", "detector": "S1_H1_clinical_certainty_hype", "detector_version": "1.7.8", "pattern_id": "hype_clinical_certainty_v1", "status": "not_detected", "evidence_status": "not_found_in_reviewed_sources", "confidence": "medium", "severity": "info", "file": ".", "line": 0, "snippet": "", "match_type": "regex", "explanation": "No evidence detected for S1_H1_clinical_certainty_hype." }, { "finding_id": "S1_H2_regulatory_approval_hype:.:0:001", "detector": "S1_H2_regulatory_approval_hype", "detector_version": "1.7.8", "pattern_id": "hype_regulatory_approval_v1", "status": "not_detected", "evidence_status": "not_found_in_reviewed_sources", "confidence": "medium", "severity": "info", "file": ".", "line": 0, "snippet": "", "match_type": "regex", "explanation": "No evidence detected for S1_H2_regulatory_approval_hype." }, { "finding_id": "S1_H3_autonomous_replacement_hype:.:0:001", "detector": "S1_H3_autonomous_replacement_hype", "detector_version": "1.7.8", "pattern_id": "hype_autonomous_replacement_v1", "status": "not_detected", "evidence_status": "not_found_in_reviewed_sources", "confidence": "medium", "severity": "info", "file": ".", "line": 0, "snippet": "", "match_type": "regex", "explanation": "No evidence detected for S1_H3_autonomous_replacement_hype." }, { "finding_id": "S1_H4_breakthrough_marketing_hype:.:0:001", "detector": "S1_H4_breakthrough_marketing_hype", "detector_version": "1.7.8", "pattern_id": "hype_breakthrough_marketing_v1", "status": "not_detected", "evidence_status": "not_found_in_reviewed_sources", "confidence": "medium", "severity": "info", "file": ".", "line": 0, "snippet": "", "match_type": "regex", "explanation": "No evidence detected for S1_H4_breakthrough_marketing_hype." }, { "finding_id": "S1_H5_universal_generalization_hype:.:0:001", "detector": "S1_H5_universal_generalization_hype", "detector_version": "1.7.8", "pattern_id": "hype_universal_generalization_v1", "status": "not_detected", "evidence_status": "not_found_in_reviewed_sources", "confidence": "medium", "severity": "info", "file": ".", "line": 0, "snippet": "", "match_type": "regex", "explanation": "No evidence detected for S1_H5_universal_generalization_hype." }, { "finding_id": "S1_H6_perfect_accuracy_hype:.:0:001", "detector": "S1_H6_perfect_accuracy_hype", "detector_version": "1.7.8", "pattern_id": "hype_perfect_accuracy_v1", "status": "not_detected", "evidence_status": "not_found_in_reviewed_sources", "confidence": "medium", "severity": "info", "file": ".", "line": 0, "snippet": "", "match_type": "regex", "explanation": "No evidence detected for S1_H6_perfect_accuracy_hype." }, { "finding_id": "S1_R1_limitations_section:.:0:001", "detector": "S1_R1_limitations_section", "detector_version": "1.7.8", "pattern_id": "limitations_section_v1", "status": "not_detected", "evidence_status": "not_found_in_reviewed_sources", "confidence": "medium", "severity": "info", "file": ".", "line": 0, "snippet": "", "match_type": "regex", "explanation": "No evidence detected for S1_R1_limitations_section." }, { "finding_id": "S1_R2_regulatory_framework:.:0:001", "detector": "S1_R2_regulatory_framework", "detector_version": "1.7.8", "pattern_id": "regulatory_framework_v1", "status": "not_detected", "evidence_status": "not_found_in_reviewed_sources", "confidence": "medium", "severity": "info", "file": ".", "line": 0, "snippet": "", "match_type": "regex", "explanation": "No evidence detected for S1_R2_regulatory_framework." }, { "finding_id": "S1_R2_weak_regulatory_self_assertion:.:0:001", "detector": "S1_R2_weak_regulatory_self_assertion", "detector_version": "1.7.8", "pattern_id": "weak_regulatory_self_assertion_v1", "status": "not_detected", "evidence_status": "not_found_in_reviewed_sources", "confidence": "medium", "severity": "info", "file": ".", "line": 0, "snippet": "", "match_type": "regex", "explanation": "No evidence detected for S1_R2_weak_regulatory_self_assertion." }, { "finding_id": "S1_R2_unsupported_legal_or_compliance_claim:.:0:001", "detector": "S1_R2_unsupported_legal_or_compliance_claim", "detector_version": "1.7.8", "pattern_id": "unsupported_legal_or_compliance_claim_v1", "status": "not_detected", "evidence_status": "not_found_in_reviewed_sources", "confidence": "medium", "severity": "info", "file": ".", "line": 0, "snippet": "", "match_type": "aggregate", "explanation": "No unsupported legal or compliance claim pattern was detected." }, { "finding_id": "S1_R4_demographic_bias_boundary:docs/SDK_DEEP_DIVE.md:305:001", "detector": "S1_R4_demographic_bias_boundary", "detector_version": "1.7.8", "pattern_id": "demographic_bias_boundary_v1", "status": "detected", "evidence_status": "confirmed_present", "confidence": "high", "severity": "info", "file": "docs/SDK_DEEP_DIVE.md", "line": 305, "snippet": "The subagent runs the full recursive EZ loop. The parent's tool execution is suspended via `await`. There is a mid-execution \"promotion\" mechanism: a synchronous subagent can be...", "match_type": "regex", "explanation": "Demographic, subgroup, fairness, bias, or validation-cohort language detected.", "metadata": { "match": "race" } }, { "finding_id": "S1_R5_reproducibility_provisions:.:0:001", "detector": "S1_R5_reproducibility_provisions", "detector_version": "1.7.8", "pattern_id": "reproducibility_provisions_v1", "status": "not_detected", "evidence_status": "not_found_in_reviewed_sources", "confidence": "medium", "severity": "info", "file": ".", "line": 0, "snippet": "", "match_type": "regex", "explanation": "No evidence detected for S1_R5_reproducibility_provisions." }, { "finding_id": "S3_T1_workflow_files:.github/workflows/skills-only.yml:0:001", "detector": "S3_T1_workflow_files", "detector_version": "1.7.8", "pattern_id": "workflow_presence_v1", "status": "detected", "evidence_status": "confirmed_present", "confidence": "high", "severity": "info", "file": ".github/workflows/skills-only.yml", "line": 0, "snippet": ".github/workflows/skills-only.yml", "match_type": "file_presence", "explanation": "Workflow file exists." }, { "finding_id": "S3_T1_workflow_files:.github/workflows/test.yml:0:001", "detector": "S3_T1_workflow_files", "detector_version": "1.7.8", "pattern_id": "workflow_presence_v1", "status": "detected", "evidence_status": "confirmed_present", "confidence": "high", "severity": "info", "file": ".github/workflows/test.yml", "line": 0, "snippet": ".github/workflows/test.yml", "match_type": "file_presence", "explanation": "Workflow file exists." }, { "finding_id": "S3_T2_domain_tests:.:0:001", "detector": "S3_T2_domain_tests", "detector_version": "1.7.8", "pattern_id": "domain_tests_bio_terms_v1", "status": "not_detected", "evidence_status": "not_found_in_reviewed_sources", "confidence": "medium", "severity": "info", "file": ".", "line": 0, "snippet": "", "match_type": "regex", "explanation": "No evidence detected for S3_T2_domain_tests." }, { "finding_id": "S3_T3_changelog_release_hygiene:.:0:001", "detector": "S3_T3_changelog_release_hygiene", "detector_version": "1.7.8", "pattern_id": "changelog_presence_v1", "status": "not_detected", "evidence_status": "not_found_in_reviewed_sources", "confidence": "medium", "severity": "info", "file": ".", "line": 0, "snippet": "", "match_type": "file_presence", "explanation": "No evidence detected for S3_T3_changelog_release_hygiene." }, { "finding_id": "S3_T3_changelog_bugfix_evidence:.:0:001", "detector": "S3_T3_changelog_bugfix_evidence", "detector_version": "1.7.8", "pattern_id": "changelog_bugfix_terms_v1", "status": "not_detected", "evidence_status": "not_found_in_reviewed_sources", "confidence": "medium", "severity": "info", "file": ".", "line": 0, "snippet": "", "match_type": "regex", "explanation": "No evidence detected for S3_T3_changelog_bugfix_evidence." }, { "finding_id": "S3_B1_dependency_manifest:package-lock.json:0:001", "detector": "S3_B1_dependency_manifest", "detector_version": "1.7.8", "pattern_id": "dependency_manifest_presence_v1", "status": "detected", "evidence_status": "confirmed_present", "confidence": "high", "severity": "info", "file": "package-lock.json", "line": 0, "snippet": "package-lock.json", "match_type": "file_presence", "explanation": "Dependency or environment manifest exists." }, { "finding_id": "S3_B1_dependency_manifest:package.json:0:001", "detector": "S3_B1_dependency_manifest", "detector_version": "1.7.8", "pattern_id": "dependency_manifest_presence_v1", "status": "detected", "evidence_status": "confirmed_present", "confidence": "high", "severity": "info", "file": "package.json", "line": 0, "snippet": "package.json", "match_type": "file_presence", "explanation": "Dependency or environment manifest exists." }, { "finding_id": "S3_B1_data_source_language:README.md:470:001", "detector": "S3_B1_data_source_language", "detector_version": "1.7.8", "pattern_id": "data_source_terms_v1", "status": "detected", "evidence_status": "confirmed_present", "confidence": "high", "severity": "info", "file": "README.md", "line": 470, "snippet": "| **SRA Toolkit** | Download data from NCBI SRA (prefetch/fasterq-dump) |", "match_type": "regex", "explanation": "Data source, dataset citation, IRB, or provenance language detected.", "metadata": { "match": "SRA" } }, { "finding_id": "S3_B1_data_source_language:README.md:470:002", "detector": "S3_B1_data_source_language", "detector_version": "1.7.8", "pattern_id": "data_source_terms_v1", "status": "detected", "evidence_status": "confirmed_present", "confidence": "high", "severity": "info", "file": "README.md", "line": 470, "snippet": "| **SRA Toolkit** | Download data from NCBI SRA (prefetch/fasterq-dump) |", "match_type": "regex", "explanation": "Data source, dataset citation, IRB, or provenance language detected.", "metadata": { "match": "SRA" } }, { "finding_id": "S3_B1_data_source_language:docs/BEGINNER_GUIDE.md:244:001", "detector": "S3_B1_data_source_language", "detector_version": "1.7.8", "pattern_id": "data_source_terms_v1", "status": "detected", "evidence_status": "confirmed_present", "confidence": "high", "severity": "info", "file": "docs/BEGINNER_GUIDE.md", "line": 244, "snippet": "- **Sequences / databases**: BLAST search, UniProt / PDB / AlphaFold / KEGG / Reactome / ClinVar / GEO / InterPro / Ensembl / OpenTarget lookups", "match_type": "regex", "explanation": "Data source, dataset citation, IRB, or provenance language detected.", "metadata": { "match": "GEO" } }, { "finding_id": "S3_B1_data_source_language:docs/BEGINNER_GUIDE.zh-CN.md:244:001", "detector": "S3_B1_data_source_language", "detector_version": "1.7.8", "pattern_id": "data_source_terms_v1", "status": "detected", "evidence_status": "confirmed_present", "confidence": "high", "severity": "info", "file": "docs/BEGINNER_GUIDE.zh-CN.md", "line": 244, "snippet": "- **\u5e8f\u5217 / \u6570\u636e\u5e93**\uff1aBLAST \u641c\u7d22\u3001\u67e5 UniProt / PDB / AlphaFold / KEGG / Reactome / ClinVar / GEO / InterPro / Ensembl / OpenTarget", "match_type": "regex", "explanation": "Data source, dataset citation, IRB, or provenance language detected.", "metadata": { "match": "GEO" } }, { "finding_id": "S3_B2_bias_limitations:docs/CHANNELS.md:105:001", "detector": "S3_B2_bias_limitations", "detector_version": "1.7.8", "pattern_id": "bias_limitations_v2", "status": "detected", "evidence_status": "confirmed_present", "confidence": "high", "severity": "info", "file": "docs/CHANNELS.md", "line": 105, "snippet": "Current limitations: image/file sending is not implemented yet.", "match_type": "regex", "explanation": "Bias, limitation, or validation-boundary language detected.", "metadata": { "match": "limitations" } }, { "finding_id": "S3_B2_bias_limitations:docs/CHANNELS.md:199:002", "detector": "S3_B2_bias_limitations", "detector_version": "1.7.8", "pattern_id": "bias_limitations_v2", "status": "detected", "evidence_status": "confirmed_present", "confidence": "high", "severity": "info", "file": "docs/CHANNELS.md", "line": 199, "snippet": "**Limitations:**", "match_type": "regex", "explanation": "Bias, limitation, or validation-boundary language detected.", "metadata": { "match": "Limitations" } }, { "finding_id": "S3_B2_measurement_evidence:.:0:001", "detector": "S3_B2_measurement_evidence", "detector_version": "1.7.8", "pattern_id": "bias_measurement_terms_v1", "status": "not_detected", "evidence_status": "not_found_in_reviewed_sources", "confidence": "medium", "severity": "info", "file": ".", "line": 0, "snippet": "", "match_type": "regex", "explanation": "No evidence detected for S3_B2_measurement_evidence." }, { "finding_id": "S3_B3_coi_funding:docs/CHANNELS.md:83:001", "detector": "S3_B3_coi_funding", "detector_version": "1.7.8", "pattern_id": "coi_funding_v1", "status": "detected", "evidence_status": "confirmed_present", "confidence": "high", "severity": "info", "file": "docs/CHANNELS.md", "line": 83, "snippet": "2. Enable the **message receive** event for your bot and grant the permissions needed to read and send IM messages.", "match_type": "regex", "explanation": "COI, funding, sponsor, or acknowledgement language detected.", "metadata": { "match": "grant" } }, { "finding_id": "S2_package_bio_terms:.:0:001", "detector": "S2_package_bio_terms", "detector_version": "1.7.8", "pattern_id": "package_bio_terms_v1", "status": "not_detected", "evidence_status": "not_found_in_reviewed_sources", "confidence": "medium", "severity": "info", "file": ".", "line": 0, "snippet": "", "match_type": "regex", "explanation": "No evidence detected for S2_package_bio_terms." }, { "finding_id": "R2R_D5_single_external_service_dependency:.:0:001", "detector": "R2R_D5_single_external_service_dependency", "detector_version": "1.7.8", "pattern_id": "single_external_service_dependency_v1", "status": "not_detected", "evidence_status": "not_found_in_reviewed_sources", "confidence": "medium", "severity": "info", "file": ".", "line": 0, "snippet": "", "match_type": "aggregate", "explanation": "No named required external service dependency pattern was detected." }, { "finding_id": "C6_mock_auth_or_fail_open_boundary:.:0:001", "detector": "C6_mock_auth_or_fail_open_boundary", "detector_version": "1.7.8", "pattern_id": "mock_auth_fail_open_boundary_v1", "status": "not_detected", "evidence_status": "not_found_in_reviewed_sources", "confidence": "medium", "severity": "info", "file": ".", "line": 0, "snippet": "", "match_type": "aggregate", "explanation": "No mock-auth or fail-open local-boundary pattern was detected." }, { "finding_id": "C1_hardcoded_credentials:scripts/setup.sh:115:001", "detector": "C1_hardcoded_credentials", "detector_version": "1.7.8", "pattern_id": "credential_pattern_v2", "status": "not_applicable", "evidence_status": "not_applicable", "confidence": "high", "severity": "info", "file": "scripts/setup.sh", "line": 115, "snippet": "sed -i.bak \"s|ANTHROPIC_API_KEY=[REDACTED]|ANTHROPIC_API_KEY=${API_KEY}|\" .env", "match_type": "regex", "explanation": "Credential-like placeholder or test/example fixture ignored for C1 penalty.", "metadata": { "match": "[REDACTED]", "placeholder": true, "fixture_context": false } }, { "finding_id": "C2_dependency_pinning:.:0:001", "detector": "C2_dependency_pinning", "detector_version": "1.7.8", "pattern_id": "loose_dependency_v1", "status": "not_detected", "evidence_status": "not_found_in_reviewed_sources", "confidence": "medium", "severity": "info", "file": ".", "line": 0, "snippet": "", "match_type": "dependency", "explanation": "No loose dependency evidence detected." }, { "finding_id": "C3_dead_or_deprecated_patient_adjacent_paths:.:0:001", "detector": "C3_dead_or_deprecated_patient_adjacent_paths", "detector_version": "1.7.8", "pattern_id": "deprecated_patient_metadata_v1", "status": "not_detected", "evidence_status": "not_found_in_reviewed_sources", "confidence": "medium", "severity": "info", "file": ".", "line": 0, "snippet": "", "match_type": "regex", "explanation": "No evidence detected for C3_dead_or_deprecated_patient_adjacent_paths." }, { "finding_id": "C4_exception_handling_clinical_adjacent_paths:.:0:001", "detector": "C4_exception_handling_clinical_adjacent_paths", "detector_version": "1.7.8", "pattern_id": "fail_open_exception_v2", "status": "not_detected", "evidence_status": "not_found_in_reviewed_sources", "confidence": "medium", "severity": "info", "file": ".", "line": 0, "snippet": "", "match_type": "ast", "explanation": "No fail-open exception handler detected in executable Python code." }, { "finding_id": "BIO_smiles_surface_integrity:.:0:001", "detector": "BIO_smiles_surface_integrity", "detector_version": "1.7.8", "pattern_id": "bio_smiles_surface_v1", "status": "not_detected", "evidence_status": "not_found_in_reviewed_sources", "confidence": "medium", "severity": "info", "file": ".", "line": 0, "snippet": "", "match_type": "ast", "explanation": "No malformed or suspicious SMILES-like strings detected by conservative surface checks." }, { "finding_id": "BIO_smiles_rdkit_validation:.:0:001", "detector": "BIO_smiles_rdkit_validation", "detector_version": "1.7.8", "pattern_id": "bio_smiles_rdkit_invalid_v1", "status": "not_detected", "evidence_status": "not_found_in_reviewed_sources", "confidence": "medium", "severity": "info", "file": ".", "line": 0, "snippet": "", "match_type": "ast", "explanation": "RDKit optional validation lane not exercised because no SMILES-like candidates were detected.", "metadata": { "lane": "A1_optional_rdkit" } }, { "finding_id": "BIO_smiles_parser_guard:.:0:001", "detector": "BIO_smiles_parser_guard", "detector_version": "1.7.8", "pattern_id": "bio_smiles_parser_guard_v1", "status": "not_detected", "evidence_status": "not_found_in_reviewed_sources", "confidence": "medium", "severity": "info", "file": ".", "line": 0, "snippet": "", "match_type": "ast", "explanation": "No missing None/invalid guards detected after SMILES parser calls." }, { "finding_id": "BIO_silent_mock_fallback:.:0:001", "detector": "BIO_silent_mock_fallback", "detector_version": "1.7.8", "pattern_id": "bio_silent_mock_v1", "status": "not_detected", "evidence_status": "not_found_in_reviewed_sources", "confidence": "medium", "severity": "info", "file": ".", "line": 0, "snippet": "", "match_type": "ast", "explanation": "No silent mock or simulated-data fallback patterns detected in production code paths." }, { "finding_id": "BIO_trace_manifest:.:0:001", "detector": "BIO_trace_manifest", "detector_version": "1.7.8", "pattern_id": "bio_trace_manifest_file_v1", "status": "not_detected", "evidence_status": "not_found_in_reviewed_sources", "confidence": "medium", "severity": "info", "file": ".", "line": 0, "snippet": "", "match_type": "file_presence", "explanation": "No traceability manifest or runtime audit-log schema surface detected." }, { "finding_id": "BIO_run_trace:.:0:001", "detector": "BIO_run_trace", "detector_version": "1.7.8", "pattern_id": "bio_run_trace_v1", "status": "not_detected", "evidence_status": "not_found_in_reviewed_sources", "confidence": "medium", "severity": "info", "file": ".", "line": 0, "snippet": "", "match_type": "ast", "explanation": "No risky subprocess or os.system bio-tool execution patterns detected." }, { "finding_id": "AST_argparse_cli:container/skills/bio-tools/templates/pymol_render_template.py:9:001", "detector": "AST_argparse_cli", "detector_version": "1.7.8", "pattern_id": "ast_argparse_cli_v1", "status": "detected", "evidence_status": "confirmed_present", "confidence": "high", "severity": "info", "file": "container/skills/bio-tools/templates/pymol_render_template.py", "line": 9, "snippet": "parser = argparse.ArgumentParser(description=\"Render a clean protein structure image with PyMOL.\")", "match_type": "ast", "explanation": "argparse CLI interface detected." }, { "finding_id": "AST_argparse_cli:container/skills/bio-tools/templates/qc_summary_plot_template.py:19:001", "detector": "AST_argparse_cli", "detector_version": "1.7.8", "pattern_id": "ast_argparse_cli_v1", "status": "detected", "evidence_status": "confirmed_present", "confidence": "high", "severity": "info", "file": "container/skills/bio-tools/templates/qc_summary_plot_template.py", "line": 19, "snippet": "parser = argparse.ArgumentParser(description=\"Create a compact QC summary plot from a CSV/TSV table.\")", "match_type": "ast", "explanation": "argparse CLI interface detected." }, { "finding_id": "AST_argparse_cli:container/skills/bio-tools/templates/volcano_plot_template.py:12:001", "detector": "AST_argparse_cli", "detector_version": "1.7.8", "pattern_id": "ast_argparse_cli_v1", "status": "detected", "evidence_status": "confirmed_present", "confidence": "high", "severity": "info", "file": "container/skills/bio-tools/templates/volcano_plot_template.py", "line": 12, "snippet": "parser = argparse.ArgumentParser(description=\"Create a publication-style volcano plot.\")", "match_type": "ast", "explanation": "argparse CLI interface detected." }, { "finding_id": "AST_argparse_cli:container/skills/sec-report/sec_pipeline.py:1184:001", "detector": "AST_argparse_cli", "detector_version": "1.7.8", "pattern_id": "ast_argparse_cli_v1", "status": "detected", "evidence_status": "confirmed_present", "confidence": "high", "severity": "info", "file": "container/skills/sec-report/sec_pipeline.py", "line": 1184, "snippet": "ap = argparse.ArgumentParser(", "match_type": "ast", "explanation": "argparse CLI interface detected." }, { "finding_id": "AST_argparse_cli:container/skills/sec-report/tests/generate_test_data.py:147:001", "detector": "AST_argparse_cli", "detector_version": "1.7.8", "pattern_id": "ast_argparse_cli_v1", "status": "detected", "evidence_status": "confirmed_present", "confidence": "high", "severity": "info", "file": "container/skills/sec-report/tests/generate_test_data.py", "line": 147, "snippet": "ap = argparse.ArgumentParser(description='Generate synthetic SEC test data')", "match_type": "ast", "explanation": "argparse CLI interface detected." }, { "finding_id": "S4_container_environment:.:0:001", "detector": "S4_container_environment", "detector_version": "1.7.8", "pattern_id": "container_file_v1", "status": "not_detected", "evidence_status": "not_found_in_reviewed_sources", "confidence": "medium", "severity": "info", "file": ".", "line": 0, "snippet": "", "match_type": "file_presence", "explanation": "No evidence detected for S4_container_environment." }, { "finding_id": "S4_make_reproduce_target:.:0:001", "detector": "S4_make_reproduce_target", "detector_version": "1.7.8", "pattern_id": "make_reproduce_target_v1", "status": "absent", "evidence_status": "confirmed_missing", "confidence": "medium", "severity": "info", "file": ".", "line": 0, "snippet": "", "match_type": "aggregate", "explanation": "No Makefile detected." }, { "finding_id": "S4_environment_lock_evidence:package-lock.json:0:001", "detector": "S4_environment_lock_evidence", "detector_version": "1.7.8", "pattern_id": "environment_lock_file_v1", "status": "detected", "evidence_status": "confirmed_present", "confidence": "high", "severity": "info", "file": "package-lock.json", "line": 0, "snippet": "package-lock.json", "match_type": "file_presence", "explanation": "Environment, dependency, or lock manifest detected." }, { "finding_id": "S4_exact_dependency_pins_or_hashes:package-lock.json:0:001", "detector": "S4_exact_dependency_pins_or_hashes", "detector_version": "1.7.8", "pattern_id": "exact_pin_or_hash_v1", "status": "detected", "evidence_status": "confirmed_present", "confidence": "high", "severity": "info", "file": "package-lock.json", "line": 0, "snippet": "package-lock.json", "match_type": "file_presence", "explanation": "Lock manifest with exact dependency resolution detected." }, { "finding_id": "S4_readme_reproducibility_section:.:0:001", "detector": "S4_readme_reproducibility_section", "detector_version": "1.7.8", "pattern_id": "readme_repro_heading_v1", "status": "not_detected", "evidence_status": "not_found_in_reviewed_sources", "confidence": "medium", "severity": "info", "file": ".", "line": 0, "snippet": "", "match_type": "aggregate", "explanation": "README exists but no reproducibility or replication section heading was detected." }, { "finding_id": "S4_checksum_files:.:0:001", "detector": "S4_checksum_files", "detector_version": "1.7.8", "pattern_id": "checksum_file_v1", "status": "not_detected", "evidence_status": "not_found_in_reviewed_sources", "confidence": "medium", "severity": "info", "file": ".", "line": 0, "snippet": "", "match_type": "file_presence", "explanation": "No evidence detected for S4_checksum_files." }, { "finding_id": "S4_dataset_url:.:0:001", "detector": "S4_dataset_url", "detector_version": "1.7.8", "pattern_id": "dataset_url_v1", "status": "not_detected", "evidence_status": "not_found_in_reviewed_sources", "confidence": "medium", "severity": "info", "file": ".", "line": 0, "snippet": "", "match_type": "aggregate", "explanation": "Documentation exists but no dataset URL or data source URL was detected." }, { "finding_id": "S4_model_weight_url_or_checksum:README.md:201:001", "detector": "S4_model_weight_url_or_checksum", "detector_version": "1.7.8", "pattern_id": "model_weight_url_v1", "status": "detected", "evidence_status": "confirmed_present", "confidence": "high", "severity": "info", "file": "README.md", "line": 201, "snippet": "Popular model IDs: `deepseek/deepseek-chat-v3.1`, `google/gemini-2.5-flash`, `anthropic/claude-3.5-sonnet`. Full list: [openrouter.ai/models](https://openrouter.ai/models)", "match_type": "regex", "explanation": "Model weight, checkpoint, or model artifact URL detected.", "metadata": { "url": "https://openrouter.ai/models" } }, { "finding_id": "S4_model_weight_url_or_checksum:docs/BEGINNER_GUIDE.md:84:001", "detector": "S4_model_weight_url_or_checksum", "detector_version": "1.7.8", "pattern_id": "model_weight_url_v1", "status": "detected", "evidence_status": "confirmed_present", "confidence": "high", "severity": "info", "file": "docs/BEGINNER_GUIDE.md", "line": 84, "snippet": "| **One API key** | Credentials to call the large language model (Anthropic, OpenRouter, etc.) | Get one at [anthropic.com](https://console.anthropic.com/) or [openrouter.ai](ht...", "match_type": "regex", "explanation": "Model weight, checkpoint, or model artifact URL detected.", "metadata": { "url": "https://console.anthropic.com/" } }, { "finding_id": "S4_citation_cff:.:0:001", "detector": "S4_citation_cff", "detector_version": "1.7.8", "pattern_id": "citation_cff_v1", "status": "not_detected", "evidence_status": "not_found_in_reviewed_sources", "confidence": "medium", "severity": "info", "file": ".", "line": 0, "snippet": "", "match_type": "file_presence", "explanation": "No evidence detected for S4_citation_cff." }, { "finding_id": "S4_license_restriction:.:0:001", "detector": "S4_license_restriction", "detector_version": "1.7.8", "pattern_id": "license_restriction_v1", "status": "not_detected", "evidence_status": "not_found_in_reviewed_sources", "confidence": "medium", "severity": "info", "file": ".", "line": 0, "snippet": "", "match_type": "aggregate", "explanation": "License/readme/docs surfaces exist but no restriction language was detected." }, { "finding_id": "S4_cli_entrypoint:.:0:001", "detector": "S4_cli_entrypoint", "detector_version": "1.7.8", "pattern_id": "cli_entrypoint_v1", "status": "detected", "evidence_status": "confirmed_present", "confidence": "medium", "severity": "info", "file": ".", "line": 0, "snippet": "", "match_type": "aggregate", "explanation": "argparse CLI evidence detected by AST summary.", "metadata": { "source": "ast_signal_summary" } }, { "finding_id": "S4_seed_setting:.:0:001", "detector": "S4_seed_setting", "detector_version": "1.7.8", "pattern_id": "ast_seed_setting_stage4_v1", "status": "not_detected", "evidence_status": "not_found_in_reviewed_sources", "confidence": "medium", "severity": "info", "file": ".", "line": 0, "snippet": "", "match_type": "aggregate", "explanation": "No deterministic seed setting evidence detected by AST summary." }, { "finding_id": "S4_runnable_examples:.:0:001", "detector": "S4_runnable_examples", "detector_version": "1.7.8", "pattern_id": "runnable_example_file_v1", "status": "not_detected", "evidence_status": "not_found_in_reviewed_sources", "confidence": "medium", "severity": "info", "file": ".", "line": 0, "snippet": "", "match_type": "file_presence", "explanation": "No evidence detected for S4_runnable_examples." } ], "detector_summary": { "total_findings": 62, "by_status": { "detected": 24, "not_detected": 36, "not_applicable": 1, "absent": 1 }, "by_detector": { "S1_readme_bio_terms": { "detected": 2 }, "S1_clinical_boundary": { "not_detected": 1 }, "S1_H1_clinical_certainty_hype": { "not_detected": 1 }, "S1_H2_regulatory_approval_hype": { "not_detected": 1 }, "S1_H3_autonomous_replacement_hype": { "not_detected": 1 }, "S1_H4_breakthrough_marketing_hype": { "not_detected": 1 }, "S1_H5_universal_generalization_hype": { "not_detected": 1 }, "S1_H6_perfect_accuracy_hype": { "not_detected": 1 }, "S1_R1_limitations_section": { "not_detected": 1 }, "S1_R2_regulatory_framework": { "not_detected": 1 }, "S1_R2_weak_regulatory_self_assertion": { "not_detected": 1 }, "S1_R2_unsupported_legal_or_compliance_claim": { "not_detected": 1 }, "S1_R4_demographic_bias_boundary": { "detected": 1 }, "S1_R5_reproducibility_provisions": { "not_detected": 1 }, "S3_T1_workflow_files": { "detected": 2 }, "S3_T2_domain_tests": { "not_detected": 1 }, "S3_T3_changelog_release_hygiene": { "not_detected": 1 }, "S3_T3_changelog_bugfix_evidence": { "not_detected": 1 }, "S3_B1_dependency_manifest": { "detected": 2 }, "S3_B1_data_source_language": { "detected": 4 }, "S3_B2_bias_limitations": { "detected": 2 }, "S3_B2_measurement_evidence": { "not_detected": 1 }, "S3_B3_coi_funding": { "detected": 1 }, "S2_package_bio_terms": { "not_detected": 1 }, "R2R_D5_single_external_service_dependency": { "not_detected": 1 }, "C6_mock_auth_or_fail_open_boundary": { "not_detected": 1 }, "C1_hardcoded_credentials": { "not_applicable": 1 }, "C2_dependency_pinning": { "not_detected": 1 }, "C3_dead_or_deprecated_patient_adjacent_paths": { "not_detected": 1 }, "C4_exception_handling_clinical_adjacent_paths": { "not_detected": 1 }, "BIO_smiles_surface_integrity": { "not_detected": 1 }, "BIO_smiles_rdkit_validation": { "not_detected": 1 }, "BIO_smiles_parser_guard": { "not_detected": 1 }, "BIO_silent_mock_fallback": { "not_detected": 1 }, "BIO_trace_manifest": { "not_detected": 1 }, "BIO_run_trace": { "not_detected": 1 }, "AST_argparse_cli": { "detected": 5 }, "S4_container_environment": { "not_detected": 1 }, "S4_make_reproduce_target": { "absent": 1 }, "S4_environment_lock_evidence": { "detected": 1 }, "S4_exact_dependency_pins_or_hashes": { "detected": 1 }, "S4_readme_reproducibility_section": { "not_detected": 1 }, "S4_checksum_files": { "not_detected": 1 }, "S4_dataset_url": { "not_detected": 1 }, "S4_model_weight_url_or_checksum": { "detected": 2 }, "S4_citation_cff": { "not_detected": 1 }, "S4_license_restriction": { "not_detected": 1 }, "S4_cli_entrypoint": { "detected": 1 }, "S4_seed_setting": { "not_detected": 1 }, "S4_runnable_examples": { "not_detected": 1 } } }, "ast_signal_summary": { "files_total": 13, "files_considered": 13, "files_parsed": 13, "files_skipped_size": 0, "syntax_errors": 0, "file_limit_exceeded": false, "test_functions": 0, "assertion_tests": 0, "public_functions": 89, "docstring_functions": 53, "annotated_functions": 74, "seed_settings": 0, "argparse_cli": true, "portable_model_loading": 0, "fail_open_handlers": 0, "docstring_coverage": 0.5955, "type_annotation_coverage": 0.8315 }, "notable_positive_evidence": [ "Package metadata was available for repo-local consistency checks.", "CI workflow files were detected.", "Documentation files were detected." ], "notable_risks": [ "Clinical-adjacent surfaces exist without an explicit non-diagnostic/non-clinical boundary.", "C5_compliance_boundary_integrity: WARN" ], "file_hashes_sha256": { "README.md": "5795125DD0539513521115583603DE57EFAC6F2E3418B11767D3215AB04E00FD" }, "method": "Deterministic local CLI scan. No LLM, network, or runtime test execution is required.", "measurement_basis": { "stage_1": "README/package bio-domain regex; hype-claim penalties; limitation, strong regulatory-framework signals, weaker self-asserted compliance signals, disclaimer, demographic-bias, and reproducibility responsibility signals", "stage_2r": "Repo-local consistency checks across README, package metadata, docs, changelog, test/CI files, and deterministic contradiction/staleness/workflow-support heuristics", "stage_3_T1": ".github/workflows/ directory contains files", "stage_3_T2": "tests/ directory contains bio-domain vocabulary (regex)", "stage_3_T3": "CHANGELOG.md, CHANGELOG, or NEWS.md file exists; max credit requires bug-fix, patch, or security entries", "stage_3_B1": "requirements.txt, pyproject.toml, or environment.yml file exists; max credit requires data-source, dataset-citation, or IRB language", "stage_3_B2": "bias/limitation vocabulary present in README and docs; max credit requires quantitative measurement evidence or related test coverage", "stage_3_B3": "funding/sponsor/COI vocabulary present in README, docs, or FUNDING.md (regex)", "stage_4": "Deterministic replication evidence lane: containers, reproducibility targets, lock/pin/hash evidence, README reproducibility sections, dataset/model artifact references, citation metadata, license/use-scope restriction evidence, CLI/seed/example signals", "ca_severity": "Clinical/diagnostic term regex match in README, docs, and package metadata", "ca_taxonomy_governance": "ca-taxonomy-v1 from runtime_regex_hardcoded_in_scanner_py; reference markdown is informative, not authoritative runtime source.", "C1": "Hardcoded key pattern regex (AWS AKIA*, sk-*, ghp_*, api_key=[REDACTED], excluding obvious placeholder/test values and test/example fixture contexts", "C2": "Dependency-manifest-only pin check across requirements/environment/setup.cfg/pyproject dependency sections; ignores non-dependency metadata lines", "C3": "Patient metadata patterns in deprecated/legacy/archive directories (regex)", "C4": "AST-backed detection of executable fail-open Python exception handlers (except/pass or except/return True)", "C6": "Mock-auth, auto-login, or no-auth local/self-host boundary signals surfaced from README/docs/config/code review", "CC1": "AST scan for public functions with confidence/threshold parameter defaulting to 0 or 0.0.", "CC2": "README code-block import names compared against package __all__; flags names claimed as importable but absent.", "CC3": "AST scan for validate_*/check_* functions using len() but no re.match/search structure check.", "airi_risk_coverage": "MIT AI Risk Repository V4_03 (airisk.mit.edu, arXiv:2408.12622) local-governed mapping: detectors cross-referenced to AIRI risk IDs through a full local registry, curated runtime bundle, and detector-mapping registry.", "BIO-Diagnostics": "Deterministic evidence-only bio diagnostics: conservative SMILES surface checks, SMILES parser-guard checks, silent mock fallback detection, traceability manifest surface checks, and subprocess bio-tool run-trace heuristics.", "REG-Scaffolding": "Evidence-only traceability scaffolding signals from manifest/hash/audit-log schema surfaces; intended as structural audit-readiness support rather than compliance proof.", "score_cap": "Score ceiling applied when clinical-adjacent signals lack explicit disclaimer" }, "calibration_profile": { "policy_schema_version": "1", "policy_version": "ca-policy-1.0", "tool_version_introduced": "1.6.5", "tool_version_last_validated": "1.7.8", "profile_name": "default", "profile_status": "authoritative_release", "profile_read_mode": "mirror_only", "policy_sha256": "3157a819a388f48d8649f1f595a2e4d513f43b5419d89ba2ee6536da0e050d91" }, "audit_freshness": { "review_after_days": 45, "freshness_basis": "clinical_adjacent_short_cycle", "expires_on": "2026-07-05", "expired": false, "anchored_commit": "faae6a2778e992b1cc6a4b1639e530a147d8b463", "hashes_available_for": [ "README.md" ], "change_triggered_reaudit_supported": true, "change_triggered_reaudit_recommended_now": false, "change_triggered_reaudit_reasons": [], "change_triggers": [ "git_commit_changed", "readme_or_docs_claim_surface_changed", "dependency_manifest_changed", "dataset_or_model_reference_changed", "ci_or_reproducibility_surface_changed", "changelog_or_release_hygiene_surface_changed" ] }, "regulatory_basis": { "registry_version": "stem-ai-regulatory-basis-registry-v1", "as_of": "May 2026", "review_required": false, "review_reasons": [], "source_ids": [ "eu_ai_act_2024_1689", "eu_ai_act_timeline_ec", "fda_qmsr", "fda_mlmd_transparency_2024", "fda_pccp_2025", "imdrf_samd_clinical_eval_2017", "imdrf_gmlp_2025" ], "note": { "title": "Regulatory basis note", "body_line_1": "Aligned to current official source classes as of May 2026: EU AI Act (Regulation (EU) 2024/1689), FDA QMSR, FDA AI-enabled device guidance themes, and IMDRF SaMD/GMLP frameworks.", "body_line_2": "This is a traceability aid, not a compliance or clearance determination." } }, "stage_traceability": { "stage_1": [ { "stage": "stage_1", "requirement_id": "EU_AI_ACT_ARTICLE_13", "mapping_confidence": "weak", "evidence_strength": "weak", "status": "signal_only", "not_assessed": [ "IFU completeness", "deployer communication workflow" ], "finding_refs": [ "R4_demographic_bias_boundary" ], "source_ids": [ "eu_ai_act_2024_1689", "fda_mlmd_transparency_2024" ], "note": "Boundary, intended-use, and limitation language is relevant to transparency scaffolding only." } ], "stage_2r": [ { "stage": "stage_2r", "requirement_id": "IMDRF_CLINICAL_CONTEXT_BOUNDARY_SIGNAL", "mapping_confidence": "weak_moderate", "evidence_strength": "weak", "status": "signal_only", "not_assessed": [ "target-population performance", "operational clinical workflow fit" ], "finding_refs": [ "R2R_D2_missing_clinical_use_boundary" ], "source_ids": [ "imdrf_samd_clinical_eval_2017" ], "note": "Repository-local contradiction and boundary signals are relevant to clinical-context traceability, not clinical validation." } ], "stage_3": [ { "stage": "stage_3", "requirement_id": "EU_AI_ACT_ARTICLE_10", "mapping_confidence": "weak", "evidence_strength": "moderate", "status": "signal_only", "not_assessed": [ "measurement correctness", "dataset adequacy", "regulator adequacy" ], "finding_refs": [ "B1_data_provenance_controls", "B2_bias_limitations" ], "source_ids": [ "eu_ai_act_2024_1689", "imdrf_samd_clinical_eval_2017" ], "note": "Provenance and bias signals are relevant to data-governance review, but do not verify execution quality." } ], "stage_4": [ { "stage": "stage_4", "requirement_id": "EU_AI_ACT_ARTICLE_12", "mapping_confidence": "moderate", "evidence_strength": "weak", "status": "partially_aligned", "not_assessed": [ "deploy-time event logging", "runtime event completeness" ], "finding_refs": [ "S4_environment_lock_evidence" ], "source_ids": [ "eu_ai_act_2024_1689", "fda_qmsr", "fda_pccp_2025" ], "note": "Reproducibility and trace manifests support record-keeping scaffolding, not operational logging completeness." } ], "bio_diagnostics": [] }, "regulatory_traceability": { "version": "stem-ai-reg-trace-v1.6", "summary": "Structural signals partially align with traceability scaffolding. This remains a pre-audit traceability aid, not a compliance determination.", "items": [ { "stage": "stage_1", "requirement_id": "EU_AI_ACT_ARTICLE_13", "mapping_confidence": "weak", "evidence_strength": "weak", "status": "signal_only", "not_assessed": [ "IFU completeness", "deployer communication workflow" ], "finding_refs": [ "R4_demographic_bias_boundary" ], "source_ids": [ "eu_ai_act_2024_1689", "fda_mlmd_transparency_2024" ], "note": "Boundary, intended-use, and limitation language is relevant to transparency scaffolding only." }, { "stage": "stage_2r", "requirement_id": "IMDRF_CLINICAL_CONTEXT_BOUNDARY_SIGNAL", "mapping_confidence": "weak_moderate", "evidence_strength": "weak", "status": "signal_only", "not_assessed": [ "target-population performance", "operational clinical workflow fit" ], "finding_refs": [ "R2R_D2_missing_clinical_use_boundary" ], "source_ids": [ "imdrf_samd_clinical_eval_2017" ], "note": "Repository-local contradiction and boundary signals are relevant to clinical-context traceability, not clinical validation." }, { "stage": "stage_3", "requirement_id": "EU_AI_ACT_ARTICLE_10", "mapping_confidence": "weak", "evidence_strength": "moderate", "status": "signal_only", "not_assessed": [ "measurement correctness", "dataset adequacy", "regulator adequacy" ], "finding_refs": [ "B1_data_provenance_controls", "B2_bias_limitations" ], "source_ids": [ "eu_ai_act_2024_1689", "imdrf_samd_clinical_eval_2017" ], "note": "Provenance and bias signals are relevant to data-governance review, but do not verify execution quality." }, { "stage": "stage_4", "requirement_id": "EU_AI_ACT_ARTICLE_12", "mapping_confidence": "moderate", "evidence_strength": "weak", "status": "partially_aligned", "not_assessed": [ "deploy-time event logging", "runtime event completeness" ], "finding_refs": [ "S4_environment_lock_evidence" ], "source_ids": [ "eu_ai_act_2024_1689", "fda_qmsr", "fda_pccp_2025" ], "note": "Reproducibility and trace manifests support record-keeping scaffolding, not operational logging completeness." } ] }, "reasoning_model": { "version": "stem-bio-ai-reasoning-v1.3.2", "policy": { "mode": "diagnostic_only", "final_score_override": false, "uses_ai": false, "weights": "uncalibrated_initial_priors_pending_benchmark_calibration" }, "evidence_budget": { "confidence": 0.6, "required_bits": 1.3219, "observed_bits": 8.4798, "unique_token_count": 356, "deficit": -7.1579, "budget_deficit_max": 1.0, "flagged": false, "status": "supported", "basis": "diagnostic_only_uncalibrated_initial_prior" }, "confidence_envelope": { "confidence": 0.6, "evidence_count": 62, "lower": 0.537, "upper": 0.663, "margin": 0.063, "basis": "diagnostic_only_uncalibrated_initial_prior" }, "lane_coherence": { "stage_scores": { "stage_1_readme_evidence": 0.7, "stage_2_repo_local_consistency": 0.5, "stage_3_code_bio": 0.54, "stage_4_replication": 0.35 }, "pairs": [ { "pair": "stage_1_readme_evidence:stage_3_code_bio", "left": 0.7, "right": 0.54, "coherence": 0.84 }, { "pair": "stage_3_code_bio:stage_4_replication", "left": 0.54, "right": 0.35, "coherence": 0.81 } ], "overall": 0.825, "status": "heuristic_consistent", "basis": "diagnostic_only_uncalibrated_initial_prior" }, "uncertainty_budget": { "stage_std": 0.1246, "manual_review_required_ratio": 0.0, "error_ratio": 0.0, "uncertainty": 0.178, "status": "low_spread", "basis": "diagnostic_only_uncalibrated_initial_prior" }, "evidence_risk_gate": { "components": { "missing_required_boundary_ratio": 1.0, "contradiction_ratio": 0.175, "manual_review_required_ratio": 0.0, "parse_error_ratio": 0.0 }, "evidence_risk": 0.4525, "risk_gate": 0.6, "risk_gate_factor": 0.2458, "status": "within_heuristic_gate", "basis": "diagnostic_only_uncalibrated_initial_prior" }, "benchmark_alignment": null } }