frc-scheduler-server: rescan

What happened, why, and what came out of it. Written by the harness from its own records; a person decides what to do with it. The same story opens the run's folder as README.md; the example's write-up is on its example page.

repository frc-scheduler-serverlanguage pythonmode rescanhead 2ad04243861bstarted 2026-09-12T01:42:31+00:00harness 0.1.0run a16348ae128b
This run has not reached the review packet yet; the last stage that wrote was intake.

Who, what, why, where, when

WhoThe AI Test Harness 0.1.0 did the work without a person in the loop. A person decides the result; nothing in this run has been merged.
WhatA scheduled scan of frc-scheduler-server at 2ad04243861b, no change under review. 7 of 64 packages carry known vulnerabilities. Tests for ecdsa 0.19.2, pdfminer-six 20231228, pillow 11.0.0, python-jose 3.3.0, python-multipart 0.0.12, starlette 0.41.3, weasyprint 63.1.
WhyThe risk score decides the budget; the two strongest reasons per package: ecdsa (score 65, budget full): reachability unknown, treated as reachable; 2 known vulnerabilities for this version. pdfminer-six (score 65, budget full): reachability unknown, treated as reachable; 4 known vulnerabilities for this version. pillow (score 65, budget full): reachability unknown, treated as reachable; 34 known vulnerabilities for this version. python-jose (score 80, budget full): reachable from first-party code; 5 known vulnerabilities for this version. python-multipart (score 65, budget full): reachability unknown, treated as reachable; 16 known vulnerabilities for this version. starlette (score 80, budget full): reachable from first-party code; 14 known vulnerabilities for this version. weasyprint (score 80, budget full): reachable from first-party code; 6 known vulnerabilities for this version.
WhereThe run's own files are in this folder.
WhenStarted 2026-09-12 01:42:31 UTC. The last stage to write was analysis at 2026-09-12 01:43:23 UTC.

Decisions the harness made

Actions it took

Actions it did not take, by design

How it happened, stage by stage

What each stage read, did and wrote, with the file behind every number.

  1. Self-verificationstage 0

    Read

    the harness's own code and the failure register

    Did

    • did not run in this run.

    Wrote

    nothing

  2. Intakestage 1

    Read

    the repository at base and head, its dependency manifest

    Did

    • Resolved 63 packages at head and 63 at base with ; looked every version up in OSV: 7 with advisories at head; 0 changed; work list of 64 rows.

    Wrote

    intake/worklist.json · intake/graph.new.json · intake/sbom.new.cdx.json · intake/vulns.json

  3. Analysisstage 2

    Read

    the work list; package source, advisories, the application's call sites

    Did

    • 7 package(s) analyzed: ecdsa score 65, budget full, 2 advisories, 0 breaking changes; pdfminer-six score 65, budget full, 4 advisories, 0 breaking changes; pillow score 65, budget full, 34 advisories, 0 breaking changes; python-jose score 80, budget full, 5 advisories, 0 breaking changes; python-multipart score 65, budget full, 16 advisories, 0 breaking changes; starlette score 80, budget full, 14 advisories, 0 breaking changes; weasyprint score 80, budget full, 6 advisories, 0 breaking changes.

    Wrote

    analyze/ecdsa/facts.json · analyze/pdfminer-six/facts.json · analyze/pillow/facts.json · analyze/python-jose/facts.json · analyze/python-multipart/facts.json · analyze/starlette/facts.json · analyze/weasyprint/facts.json

  4. Generationstage 3

    Read

    the fact bundle per package; the model; the sealed sandbox for baseline runs

    Did

    • did not run in this run.

    Wrote

    nothing

  5. Validation executionstage 4

    Read

    the candidate tests; the environments at head, base or the fixed candidate

    Did

    • did not run in this run.

    Wrote

    nothing

  6. Triagestage 5

    Read

    every verdict and finding from stage 4

    Did

    • did not run in this run.

    Wrote

    nothing

  7. Packetstage 6

    Read

    triage, the tests, the advisories

    Did

    • did not run in this run.

    Wrote

    nothing

  8. Attestationstage attest

    Read

    the manifest, the tests, the results; UDLM's chain code

    Did

    • did not run in this run.

    Wrote

    nothing

  9. Assessmentstage assess

    Read

    every record the run wrote, against the blueprint's goals

    Did

    • did not run in this run.

    Wrote

    nothing

  10. Test pull requeststage propose

    Read

    the packet and the records

    Did

    • did not run in this run.

    Wrote

    nothing

  11. Feedbackstage 7

    Read

    the pull request as a person decided it

    Did

    • did not run in this run.

    Wrote

    nothing

What is in this folder, and who it is for

What is in this folder, and who it is for

Every file exists for a reader or a tool named here. The plain-English files come first; the machine files stay because they are the proof and the replay.

Everyone

  • README.md: The story of this run: who, what, why, where, when, the outcome, the decisions and the actions.

Reviewers (the developer or team that owns the change)

  • intake/worklist.json: The work list: every package at base and head, what changed, what is reachable, what carries advisories.
  • analyze/ecdsa/facts.json: The fact bundle for one package: versions, API diff, call sites, advisories, the risk score and the budget it earned.
  • analyze/pdfminer-six/facts.json: The fact bundle for one package: versions, API diff, call sites, advisories, the risk score and the budget it earned.
  • analyze/pillow/facts.json: The fact bundle for one package: versions, API diff, call sites, advisories, the risk score and the budget it earned.
  • analyze/python-jose/facts.json: The fact bundle for one package: versions, API diff, call sites, advisories, the risk score and the budget it earned.
  • analyze/python-multipart/facts.json: The fact bundle for one package: versions, API diff, call sites, advisories, the risk score and the budget it earned.
  • analyze/starlette/facts.json: The fact bundle for one package: versions, API diff, call sites, advisories, the risk score and the budget it earned.
  • analyze/weasyprint/facts.json: The fact bundle for one package: versions, API diff, call sites, advisories, the risk score and the budget it earned.

Product Security

Supply Chain Security and auditors

The person who ran the harness

Tools (kept for replay and proof; not meant to be read)