{
  "schema": "membra.systemlake.risk_register.v1",
  "generated_at": "2026-06-21T18:27:21.352197",
  "risks": [
    {
      "system": "Downloads",
      "risk_type": "missing_license",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No license file found \u2014 IP clarity unclear",
      "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)."
    },
    {
      "system": "Downloads",
      "risk_type": "no_tests",
      "severity": "medium",
      "haircut": 10,
      "classification": "missing_evidence",
      "description": "No test coverage \u2014 functionality unverified",
      "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest."
    },
    {
      "system": "agent-workforce",
      "risk_type": "secret_leak",
      "severity": "low",
      "haircut": 8,
      "classification": "real",
      "description": "Exposed secrets or credentials detected",
      "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager."
    },
    {
      "system": "agent-workforce",
      "risk_type": "missing_license",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No license file found \u2014 IP clarity unclear",
      "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)."
    },
    {
      "system": "agent-workforce",
      "risk_type": "no_tests",
      "severity": "medium",
      "haircut": 10,
      "classification": "missing_evidence",
      "description": "No test coverage \u2014 functionality unverified",
      "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest."
    },
    {
      "system": "agent-workforce",
      "risk_type": "no_receipts",
      "severity": "low",
      "haircut": 8,
      "classification": "missing_evidence",
      "description": "No execution receipts \u2014 claims unverifiable",
      "remediation": "Generate execution receipts for build/test/deploy commands."
    },
    {
      "system": "agent-workforce",
      "risk_type": "dependency_vulnerability",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No lockfile \u2014 dependency versions not pinned",
      "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)."
    },
    {
      "system": "api",
      "risk_type": "missing_license",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No license file found \u2014 IP clarity unclear",
      "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)."
    },
    {
      "system": "api",
      "risk_type": "no_tests",
      "severity": "medium",
      "haircut": 10,
      "classification": "missing_evidence",
      "description": "No test coverage \u2014 functionality unverified",
      "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest."
    },
    {
      "system": "api",
      "risk_type": "no_receipts",
      "severity": "low",
      "haircut": 8,
      "classification": "missing_evidence",
      "description": "No execution receipts \u2014 claims unverifiable",
      "remediation": "Generate execution receipts for build/test/deploy commands."
    },
    {
      "system": "api",
      "risk_type": "prototype_sprawl",
      "severity": "low",
      "haircut": 5,
      "classification": "false_positive",
      "description": "Prototype sprawl \u2014 too few or too many files",
      "remediation": "Consolidate or document the system scope."
    },
    {
      "system": "api",
      "risk_type": "dependency_vulnerability",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No lockfile \u2014 dependency versions not pinned",
      "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)."
    },
    {
      "system": "api_integration_system",
      "risk_type": "secret_leak",
      "severity": "low",
      "haircut": 8,
      "classification": "real",
      "description": "Exposed secrets or credentials detected",
      "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager."
    },
    {
      "system": "api_integration_system",
      "risk_type": "missing_license",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No license file found \u2014 IP clarity unclear",
      "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)."
    },
    {
      "system": "api_integration_system",
      "risk_type": "no_tests",
      "severity": "medium",
      "haircut": 10,
      "classification": "missing_evidence",
      "description": "No test coverage \u2014 functionality unverified",
      "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest."
    },
    {
      "system": "api_integration_system",
      "risk_type": "no_receipts",
      "severity": "low",
      "haircut": 8,
      "classification": "missing_evidence",
      "description": "No execution receipts \u2014 claims unverifiable",
      "remediation": "Generate execution receipts for build/test/deploy commands."
    },
    {
      "system": "api_integration_system",
      "risk_type": "dependency_vulnerability",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No lockfile \u2014 dependency versions not pinned",
      "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)."
    },
    {
      "system": "autonomous-cleanstat-agent",
      "risk_type": "secret_leak",
      "severity": "low",
      "haircut": 8,
      "classification": "real",
      "description": "Exposed secrets or credentials detected",
      "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager."
    },
    {
      "system": "autonomous-cleanstat-agent",
      "risk_type": "missing_license",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No license file found \u2014 IP clarity unclear",
      "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)."
    },
    {
      "system": "autonomous-cleanstat-agent",
      "risk_type": "no_receipts",
      "severity": "low",
      "haircut": 8,
      "classification": "missing_evidence",
      "description": "No execution receipts \u2014 claims unverifiable",
      "remediation": "Generate execution receipts for build/test/deploy commands."
    },
    {
      "system": "autonomous-cleanstat-agent",
      "risk_type": "dependency_vulnerability",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No lockfile \u2014 dependency versions not pinned",
      "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)."
    },
    {
      "system": "backend",
      "risk_type": "missing_license",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No license file found \u2014 IP clarity unclear",
      "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)."
    },
    {
      "system": "backend",
      "risk_type": "dependency_vulnerability",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No lockfile \u2014 dependency versions not pinned",
      "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)."
    },
    {
      "system": "bitcoin-bearer-notes",
      "risk_type": "secret_leak",
      "severity": "low",
      "haircut": 8,
      "classification": "real",
      "description": "Exposed secrets or credentials detected",
      "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager."
    },
    {
      "system": "bitcoin-bearer-notes",
      "risk_type": "missing_license",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No license file found \u2014 IP clarity unclear",
      "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)."
    },
    {
      "system": "bitcoin-bearer-notes",
      "risk_type": "no_tests",
      "severity": "medium",
      "haircut": 10,
      "classification": "missing_evidence",
      "description": "No test coverage \u2014 functionality unverified",
      "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest."
    },
    {
      "system": "bitcoin-bearer-notes",
      "risk_type": "no_receipts",
      "severity": "low",
      "haircut": 8,
      "classification": "missing_evidence",
      "description": "No execution receipts \u2014 claims unverifiable",
      "remediation": "Generate execution receipts for build/test/deploy commands."
    },
    {
      "system": "bitcoin-bearer-notes",
      "risk_type": "dependency_vulnerability",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No lockfile \u2014 dependency versions not pinned",
      "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)."
    },
    {
      "system": "chat-provenance-api",
      "risk_type": "secret_leak",
      "severity": "low",
      "haircut": 8,
      "classification": "real",
      "description": "Exposed secrets or credentials detected",
      "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager."
    },
    {
      "system": "chat-provenance-api",
      "risk_type": "missing_license",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No license file found \u2014 IP clarity unclear",
      "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)."
    },
    {
      "system": "chat-provenance-api",
      "risk_type": "no_tests",
      "severity": "medium",
      "haircut": 10,
      "classification": "missing_evidence",
      "description": "No test coverage \u2014 functionality unverified",
      "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest."
    },
    {
      "system": "chat-provenance-api",
      "risk_type": "no_receipts",
      "severity": "low",
      "haircut": 8,
      "classification": "missing_evidence",
      "description": "No execution receipts \u2014 claims unverifiable",
      "remediation": "Generate execution receipts for build/test/deploy commands."
    },
    {
      "system": "chat-provenance-api",
      "risk_type": "dependency_vulnerability",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No lockfile \u2014 dependency versions not pinned",
      "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)."
    },
    {
      "system": "cleanstat-autonomous-agent",
      "risk_type": "secret_leak",
      "severity": "low",
      "haircut": 8,
      "classification": "real",
      "description": "Exposed secrets or credentials detected",
      "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager."
    },
    {
      "system": "cleanstat-autonomous-agent",
      "risk_type": "missing_license",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No license file found \u2014 IP clarity unclear",
      "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)."
    },
    {
      "system": "cleanstat-autonomous-agent",
      "risk_type": "no_tests",
      "severity": "medium",
      "haircut": 10,
      "classification": "missing_evidence",
      "description": "No test coverage \u2014 functionality unverified",
      "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest."
    },
    {
      "system": "cleanstat-autonomous-agent",
      "risk_type": "no_receipts",
      "severity": "low",
      "haircut": 8,
      "classification": "missing_evidence",
      "description": "No execution receipts \u2014 claims unverifiable",
      "remediation": "Generate execution receipts for build/test/deploy commands."
    },
    {
      "system": "cleanstat-autonomous-agent",
      "risk_type": "dependency_vulnerability",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No lockfile \u2014 dependency versions not pinned",
      "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)."
    },
    {
      "system": "cleanstat-infrastructure",
      "risk_type": "secret_leak",
      "severity": "low",
      "haircut": 8,
      "classification": "real",
      "description": "Exposed secrets or credentials detected",
      "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager."
    },
    {
      "system": "cleanstat-infrastructure",
      "risk_type": "missing_license",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No license file found \u2014 IP clarity unclear",
      "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)."
    },
    {
      "system": "cleanstat-infrastructure",
      "risk_type": "no_tests",
      "severity": "medium",
      "haircut": 10,
      "classification": "missing_evidence",
      "description": "No test coverage \u2014 functionality unverified",
      "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest."
    },
    {
      "system": "cleanstat-infrastructure",
      "risk_type": "no_receipts",
      "severity": "low",
      "haircut": 8,
      "classification": "missing_evidence",
      "description": "No execution receipts \u2014 claims unverifiable",
      "remediation": "Generate execution receipts for build/test/deploy commands."
    },
    {
      "system": "cleanstat-infrastructure",
      "risk_type": "dependency_vulnerability",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No lockfile \u2014 dependency versions not pinned",
      "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)."
    },
    {
      "system": "config_data_files",
      "risk_type": "secret_leak",
      "severity": "low",
      "haircut": 9.0,
      "classification": "real",
      "description": "Exposed secrets or credentials detected",
      "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager."
    },
    {
      "system": "config_data_files",
      "risk_type": "missing_license",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No license file found \u2014 IP clarity unclear",
      "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)."
    },
    {
      "system": "config_data_files",
      "risk_type": "no_receipts",
      "severity": "low",
      "haircut": 8,
      "classification": "missing_evidence",
      "description": "No execution receipts \u2014 claims unverifiable",
      "remediation": "Generate execution receipts for build/test/deploy commands."
    },
    {
      "system": "config_data_files",
      "risk_type": "dependency_vulnerability",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No lockfile \u2014 dependency versions not pinned",
      "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)."
    },
    {
      "system": "decloud",
      "risk_type": "missing_license",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No license file found \u2014 IP clarity unclear",
      "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)."
    },
    {
      "system": "decloud",
      "risk_type": "no_receipts",
      "severity": "low",
      "haircut": 8,
      "classification": "missing_evidence",
      "description": "No execution receipts \u2014 claims unverifiable",
      "remediation": "Generate execution receipts for build/test/deploy commands."
    },
    {
      "system": "decloud",
      "risk_type": "dependency_vulnerability",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No lockfile \u2014 dependency versions not pinned",
      "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)."
    },
    {
      "system": "docs",
      "risk_type": "missing_license",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No license file found \u2014 IP clarity unclear",
      "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)."
    },
    {
      "system": "docs",
      "risk_type": "no_tests",
      "severity": "medium",
      "haircut": 10,
      "classification": "missing_evidence",
      "description": "No test coverage \u2014 functionality unverified",
      "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest."
    },
    {
      "system": "docs",
      "risk_type": "no_receipts",
      "severity": "low",
      "haircut": 8,
      "classification": "missing_evidence",
      "description": "No execution receipts \u2014 claims unverifiable",
      "remediation": "Generate execution receipts for build/test/deploy commands."
    },
    {
      "system": "docs",
      "risk_type": "dependency_vulnerability",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No lockfile \u2014 dependency versions not pinned",
      "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)."
    },
    {
      "system": "field-triage-app",
      "risk_type": "missing_license",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No license file found \u2014 IP clarity unclear",
      "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)."
    },
    {
      "system": "field-triage-app",
      "risk_type": "no_tests",
      "severity": "medium",
      "haircut": 10,
      "classification": "missing_evidence",
      "description": "No test coverage \u2014 functionality unverified",
      "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest."
    },
    {
      "system": "field-triage-app",
      "risk_type": "no_receipts",
      "severity": "low",
      "haircut": 8,
      "classification": "missing_evidence",
      "description": "No execution receipts \u2014 claims unverifiable",
      "remediation": "Generate execution receipts for build/test/deploy commands."
    },
    {
      "system": "field-triage-app",
      "risk_type": "dependency_vulnerability",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No lockfile \u2014 dependency versions not pinned",
      "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)."
    },
    {
      "system": "files",
      "risk_type": "secret_leak",
      "severity": "low",
      "haircut": 3.0,
      "classification": "real",
      "description": "Exposed secrets or credentials detected",
      "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager."
    },
    {
      "system": "files",
      "risk_type": "missing_license",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No license file found \u2014 IP clarity unclear",
      "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)."
    },
    {
      "system": "files",
      "risk_type": "no_receipts",
      "severity": "low",
      "haircut": 8,
      "classification": "missing_evidence",
      "description": "No execution receipts \u2014 claims unverifiable",
      "remediation": "Generate execution receipts for build/test/deploy commands."
    },
    {
      "system": "files",
      "risk_type": "dependency_vulnerability",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No lockfile \u2014 dependency versions not pinned",
      "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)."
    },
    {
      "system": "files_cpp",
      "risk_type": "secret_leak",
      "severity": "low",
      "haircut": 8,
      "classification": "real",
      "description": "Exposed secrets or credentials detected",
      "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager."
    },
    {
      "system": "files_cpp",
      "risk_type": "missing_license",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No license file found \u2014 IP clarity unclear",
      "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)."
    },
    {
      "system": "files_cpp",
      "risk_type": "no_receipts",
      "severity": "low",
      "haircut": 8,
      "classification": "missing_evidence",
      "description": "No execution receipts \u2014 claims unverifiable",
      "remediation": "Generate execution receipts for build/test/deploy commands."
    },
    {
      "system": "frontend",
      "risk_type": "secret_leak",
      "severity": "low",
      "haircut": 8,
      "classification": "real",
      "description": "Exposed secrets or credentials detected",
      "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager."
    },
    {
      "system": "frontend",
      "risk_type": "missing_license",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No license file found \u2014 IP clarity unclear",
      "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)."
    },
    {
      "system": "frontend",
      "risk_type": "no_tests",
      "severity": "medium",
      "haircut": 10,
      "classification": "missing_evidence",
      "description": "No test coverage \u2014 functionality unverified",
      "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest."
    },
    {
      "system": "ios",
      "risk_type": "missing_license",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No license file found \u2014 IP clarity unclear",
      "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)."
    },
    {
      "system": "ios",
      "risk_type": "no_tests",
      "severity": "medium",
      "haircut": 10,
      "classification": "missing_evidence",
      "description": "No test coverage \u2014 functionality unverified",
      "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest."
    },
    {
      "system": "ios",
      "risk_type": "no_receipts",
      "severity": "low",
      "haircut": 8,
      "classification": "missing_evidence",
      "description": "No execution receipts \u2014 claims unverifiable",
      "remediation": "Generate execution receipts for build/test/deploy commands."
    },
    {
      "system": "ios",
      "risk_type": "dependency_vulnerability",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No lockfile \u2014 dependency versions not pinned",
      "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)."
    },
    {
      "system": "kamino-flash-executor",
      "risk_type": "secret_leak",
      "severity": "low",
      "haircut": 8,
      "classification": "real",
      "description": "Exposed secrets or credentials detected",
      "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager."
    },
    {
      "system": "kamino-flash-executor",
      "risk_type": "missing_license",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No license file found \u2014 IP clarity unclear",
      "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)."
    },
    {
      "system": "kamino-flash-executor",
      "risk_type": "no_tests",
      "severity": "medium",
      "haircut": 10,
      "classification": "missing_evidence",
      "description": "No test coverage \u2014 functionality unverified",
      "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest."
    },
    {
      "system": "kamino-flash-executor",
      "risk_type": "no_receipts",
      "severity": "low",
      "haircut": 8,
      "classification": "missing_evidence",
      "description": "No execution receipts \u2014 claims unverifiable",
      "remediation": "Generate execution receipts for build/test/deploy commands."
    },
    {
      "system": "kamino-flash-executor",
      "risk_type": "dependency_vulnerability",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No lockfile \u2014 dependency versions not pinned",
      "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)."
    },
    {
      "system": "live-kamino-jupiter-flash-arb",
      "risk_type": "secret_leak",
      "severity": "low",
      "haircut": 8,
      "classification": "real",
      "description": "Exposed secrets or credentials detected",
      "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager."
    },
    {
      "system": "live-kamino-jupiter-flash-arb",
      "risk_type": "missing_license",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No license file found \u2014 IP clarity unclear",
      "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)."
    },
    {
      "system": "live-kamino-jupiter-flash-arb",
      "risk_type": "no_tests",
      "severity": "medium",
      "haircut": 10,
      "classification": "missing_evidence",
      "description": "No test coverage \u2014 functionality unverified",
      "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest."
    },
    {
      "system": "live-kamino-jupiter-flash-arb",
      "risk_type": "no_receipts",
      "severity": "low",
      "haircut": 8,
      "classification": "missing_evidence",
      "description": "No execution receipts \u2014 claims unverifiable",
      "remediation": "Generate execution receipts for build/test/deploy commands."
    },
    {
      "system": "live-kamino-jupiter-flash-arb",
      "risk_type": "dependency_vulnerability",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No lockfile \u2014 dependency versions not pinned",
      "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)."
    },
    {
      "system": "mac_compute_node",
      "risk_type": "missing_license",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No license file found \u2014 IP clarity unclear",
      "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)."
    },
    {
      "system": "mac_compute_node",
      "risk_type": "no_tests",
      "severity": "medium",
      "haircut": 10,
      "classification": "missing_evidence",
      "description": "No test coverage \u2014 functionality unverified",
      "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest."
    },
    {
      "system": "mac_compute_node",
      "risk_type": "no_receipts",
      "severity": "low",
      "haircut": 8,
      "classification": "missing_evidence",
      "description": "No execution receipts \u2014 claims unverifiable",
      "remediation": "Generate execution receipts for build/test/deploy commands."
    },
    {
      "system": "mac_compute_node",
      "risk_type": "dependency_vulnerability",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No lockfile \u2014 dependency versions not pinned",
      "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)."
    },
    {
      "system": "membra-ads",
      "risk_type": "secret_leak",
      "severity": "low",
      "haircut": 8,
      "classification": "real",
      "description": "Exposed secrets or credentials detected",
      "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager."
    },
    {
      "system": "membra-ads",
      "risk_type": "missing_license",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No license file found \u2014 IP clarity unclear",
      "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)."
    },
    {
      "system": "membra-ads",
      "risk_type": "no_tests",
      "severity": "medium",
      "haircut": 10,
      "classification": "missing_evidence",
      "description": "No test coverage \u2014 functionality unverified",
      "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest."
    },
    {
      "system": "membra-ads",
      "risk_type": "no_receipts",
      "severity": "low",
      "haircut": 8,
      "classification": "missing_evidence",
      "description": "No execution receipts \u2014 claims unverifiable",
      "remediation": "Generate execution receipts for build/test/deploy commands."
    },
    {
      "system": "membra-ads",
      "risk_type": "dependency_vulnerability",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No lockfile \u2014 dependency versions not pinned",
      "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)."
    },
    {
      "system": "membra-bridge-ecosystem",
      "risk_type": "secret_leak",
      "severity": "medium",
      "haircut": 11,
      "classification": "real",
      "description": "Exposed secrets or credentials detected",
      "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager."
    },
    {
      "system": "membra-bridge-ecosystem",
      "risk_type": "missing_license",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No license file found \u2014 IP clarity unclear",
      "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)."
    },
    {
      "system": "membra-bridge-ecosystem",
      "risk_type": "no_tests",
      "severity": "medium",
      "haircut": 10,
      "classification": "missing_evidence",
      "description": "No test coverage \u2014 functionality unverified",
      "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest."
    },
    {
      "system": "membra-bridge-ecosystem",
      "risk_type": "no_receipts",
      "severity": "low",
      "haircut": 8,
      "classification": "missing_evidence",
      "description": "No execution receipts \u2014 claims unverifiable",
      "remediation": "Generate execution receipts for build/test/deploy commands."
    },
    {
      "system": "membra-bridge-ecosystem",
      "risk_type": "dependency_vulnerability",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No lockfile \u2014 dependency versions not pinned",
      "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)."
    },
    {
      "system": "membra-economics",
      "risk_type": "secret_leak",
      "severity": "high",
      "haircut": 30,
      "classification": "real",
      "description": "Exposed secrets or credentials detected",
      "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager."
    },
    {
      "system": "membra-economics",
      "risk_type": "no_tests",
      "severity": "medium",
      "haircut": 10,
      "classification": "missing_evidence",
      "description": "No test coverage \u2014 functionality unverified",
      "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest."
    },
    {
      "system": "membra-economics",
      "risk_type": "pii_sensitive_data",
      "severity": "medium",
      "haircut": 10,
      "classification": "real",
      "description": "PII or sensitive data files present",
      "remediation": "Remove or encrypt PII files. Add to .gitignore."
    },
    {
      "system": "membra-economics",
      "risk_type": "prototype_sprawl",
      "severity": "low",
      "haircut": 5,
      "classification": "false_positive",
      "description": "Prototype sprawl \u2014 too few or too many files",
      "remediation": "Consolidate or document the system scope."
    },
    {
      "system": "membra-ecosystem",
      "risk_type": "secret_leak",
      "severity": "low",
      "haircut": 8,
      "classification": "real",
      "description": "Exposed secrets or credentials detected",
      "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager."
    },
    {
      "system": "membra-ecosystem",
      "risk_type": "no_tests",
      "severity": "medium",
      "haircut": 10,
      "classification": "missing_evidence",
      "description": "No test coverage \u2014 functionality unverified",
      "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest."
    },
    {
      "system": "membra-ecosystem",
      "risk_type": "no_receipts",
      "severity": "low",
      "haircut": 8,
      "classification": "missing_evidence",
      "description": "No execution receipts \u2014 claims unverifiable",
      "remediation": "Generate execution receipts for build/test/deploy commands."
    },
    {
      "system": "membra-ecosystem",
      "risk_type": "pii_sensitive_data",
      "severity": "medium",
      "haircut": 10,
      "classification": "real",
      "description": "PII or sensitive data files present",
      "remediation": "Remove or encrypt PII files. Add to .gitignore."
    },
    {
      "system": "membra-ecosystem",
      "risk_type": "dependency_vulnerability",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No lockfile \u2014 dependency versions not pinned",
      "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)."
    },
    {
      "system": "membra-kpi-mobile",
      "risk_type": "missing_license",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No license file found \u2014 IP clarity unclear",
      "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)."
    },
    {
      "system": "membra-kpi-mobile",
      "risk_type": "no_tests",
      "severity": "medium",
      "haircut": 10,
      "classification": "missing_evidence",
      "description": "No test coverage \u2014 functionality unverified",
      "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest."
    },
    {
      "system": "membra-kpi-mobile",
      "risk_type": "no_receipts",
      "severity": "low",
      "haircut": 8,
      "classification": "missing_evidence",
      "description": "No execution receipts \u2014 claims unverifiable",
      "remediation": "Generate execution receipts for build/test/deploy commands."
    },
    {
      "system": "membra-kpi-mobile",
      "risk_type": "dependency_vulnerability",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No lockfile \u2014 dependency versions not pinned",
      "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)."
    },
    {
      "system": "membra-l3",
      "risk_type": "secret_leak",
      "severity": "low",
      "haircut": 3.0,
      "classification": "real",
      "description": "Exposed secrets or credentials detected",
      "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager."
    },
    {
      "system": "membra-l3",
      "risk_type": "missing_license",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No license file found \u2014 IP clarity unclear",
      "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)."
    },
    {
      "system": "membra-l3",
      "risk_type": "no_tests",
      "severity": "medium",
      "haircut": 10,
      "classification": "missing_evidence",
      "description": "No test coverage \u2014 functionality unverified",
      "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest."
    },
    {
      "system": "membra-l3",
      "risk_type": "no_receipts",
      "severity": "low",
      "haircut": 8,
      "classification": "missing_evidence",
      "description": "No execution receipts \u2014 claims unverifiable",
      "remediation": "Generate execution receipts for build/test/deploy commands."
    },
    {
      "system": "membra-l3",
      "risk_type": "dependency_vulnerability",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No lockfile \u2014 dependency versions not pinned",
      "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)."
    },
    {
      "system": "membra-operator",
      "risk_type": "missing_license",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No license file found \u2014 IP clarity unclear",
      "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)."
    },
    {
      "system": "membra-operator",
      "risk_type": "no_receipts",
      "severity": "low",
      "haircut": 8,
      "classification": "missing_evidence",
      "description": "No execution receipts \u2014 claims unverifiable",
      "remediation": "Generate execution receipts for build/test/deploy commands."
    },
    {
      "system": "membra-operator",
      "risk_type": "dependency_vulnerability",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No lockfile \u2014 dependency versions not pinned",
      "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)."
    },
    {
      "system": "membra-qr-gateway",
      "risk_type": "secret_leak",
      "severity": "low",
      "haircut": 6.0,
      "classification": "real",
      "description": "Exposed secrets or credentials detected",
      "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager."
    },
    {
      "system": "membra-qr-gateway",
      "risk_type": "missing_license",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No license file found \u2014 IP clarity unclear",
      "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)."
    },
    {
      "system": "membra-qr-gateway",
      "risk_type": "no_tests",
      "severity": "medium",
      "haircut": 10,
      "classification": "missing_evidence",
      "description": "No test coverage \u2014 functionality unverified",
      "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest."
    },
    {
      "system": "membra-semantic-consensus",
      "risk_type": "secret_leak",
      "severity": "low",
      "haircut": 8,
      "classification": "real",
      "description": "Exposed secrets or credentials detected",
      "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager."
    },
    {
      "system": "membra-semantic-consensus",
      "risk_type": "no_tests",
      "severity": "medium",
      "haircut": 10,
      "classification": "missing_evidence",
      "description": "No test coverage \u2014 functionality unverified",
      "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest."
    },
    {
      "system": "membra-semantic-consensus",
      "risk_type": "dependency_vulnerability",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No lockfile \u2014 dependency versions not pinned",
      "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)."
    },
    {
      "system": "membra_mobile",
      "risk_type": "secret_leak",
      "severity": "low",
      "haircut": 8,
      "classification": "real",
      "description": "Exposed secrets or credentials detected",
      "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager."
    },
    {
      "system": "membra_mobile",
      "risk_type": "no_tests",
      "severity": "medium",
      "haircut": 10,
      "classification": "missing_evidence",
      "description": "No test coverage \u2014 functionality unverified",
      "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest."
    },
    {
      "system": "membra_mobile",
      "risk_type": "no_receipts",
      "severity": "low",
      "haircut": 8,
      "classification": "missing_evidence",
      "description": "No execution receipts \u2014 claims unverifiable",
      "remediation": "Generate execution receipts for build/test/deploy commands."
    },
    {
      "system": "membra_mobile",
      "risk_type": "dependency_vulnerability",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No lockfile \u2014 dependency versions not pinned",
      "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)."
    },
    {
      "system": "membramoney",
      "risk_type": "secret_leak",
      "severity": "high",
      "haircut": 30,
      "classification": "real",
      "description": "Exposed secrets or credentials detected",
      "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager."
    },
    {
      "system": "membramoney",
      "risk_type": "pii_sensitive_data",
      "severity": "medium",
      "haircut": 10,
      "classification": "real",
      "description": "PII or sensitive data files present",
      "remediation": "Remove or encrypt PII files. Add to .gitignore."
    },
    {
      "system": "membramoney",
      "risk_type": "dependency_vulnerability",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No lockfile \u2014 dependency versions not pinned",
      "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)."
    },
    {
      "system": "overmanifold",
      "risk_type": "secret_leak",
      "severity": "medium",
      "haircut": 18,
      "classification": "real",
      "description": "Exposed secrets or credentials detected",
      "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager."
    },
    {
      "system": "overmanifold",
      "risk_type": "missing_license",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No license file found \u2014 IP clarity unclear",
      "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)."
    },
    {
      "system": "overmanifold",
      "risk_type": "no_receipts",
      "severity": "low",
      "haircut": 8,
      "classification": "missing_evidence",
      "description": "No execution receipts \u2014 claims unverifiable",
      "remediation": "Generate execution receipts for build/test/deploy commands."
    },
    {
      "system": "overmanifold",
      "risk_type": "dependency_vulnerability",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No lockfile \u2014 dependency versions not pinned",
      "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)."
    },
    {
      "system": "protocol",
      "risk_type": "secret_leak",
      "severity": "low",
      "haircut": 3.0,
      "classification": "real",
      "description": "Exposed secrets or credentials detected",
      "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager."
    },
    {
      "system": "protocol",
      "risk_type": "missing_license",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No license file found \u2014 IP clarity unclear",
      "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)."
    },
    {
      "system": "protocol",
      "risk_type": "no_tests",
      "severity": "medium",
      "haircut": 10,
      "classification": "missing_evidence",
      "description": "No test coverage \u2014 functionality unverified",
      "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest."
    },
    {
      "system": "protocol",
      "risk_type": "no_receipts",
      "severity": "low",
      "haircut": 8,
      "classification": "missing_evidence",
      "description": "No execution receipts \u2014 claims unverifiable",
      "remediation": "Generate execution receipts for build/test/deploy commands."
    },
    {
      "system": "protocol",
      "risk_type": "dependency_vulnerability",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No lockfile \u2014 dependency versions not pinned",
      "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)."
    },
    {
      "system": "setup_installation_systems",
      "risk_type": "secret_leak",
      "severity": "low",
      "haircut": 6.0,
      "classification": "real",
      "description": "Exposed secrets or credentials detected",
      "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager."
    },
    {
      "system": "setup_installation_systems",
      "risk_type": "missing_license",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No license file found \u2014 IP clarity unclear",
      "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)."
    },
    {
      "system": "setup_installation_systems",
      "risk_type": "no_tests",
      "severity": "medium",
      "haircut": 10,
      "classification": "missing_evidence",
      "description": "No test coverage \u2014 functionality unverified",
      "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest."
    },
    {
      "system": "setup_installation_systems",
      "risk_type": "no_receipts",
      "severity": "low",
      "haircut": 8,
      "classification": "missing_evidence",
      "description": "No execution receipts \u2014 claims unverifiable",
      "remediation": "Generate execution receipts for build/test/deploy commands."
    },
    {
      "system": "sniffies-rentals",
      "risk_type": "missing_license",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No license file found \u2014 IP clarity unclear",
      "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)."
    },
    {
      "system": "sniffies-rentals",
      "risk_type": "no_tests",
      "severity": "medium",
      "haircut": 10,
      "classification": "missing_evidence",
      "description": "No test coverage \u2014 functionality unverified",
      "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest."
    },
    {
      "system": "sniffies-rentals",
      "risk_type": "no_receipts",
      "severity": "low",
      "haircut": 8,
      "classification": "missing_evidence",
      "description": "No execution receipts \u2014 claims unverifiable",
      "remediation": "Generate execution receipts for build/test/deploy commands."
    },
    {
      "system": "sniffies-rentals",
      "risk_type": "dependency_vulnerability",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No lockfile \u2014 dependency versions not pinned",
      "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)."
    },
    {
      "system": "solana-staking-tracker",
      "risk_type": "missing_license",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No license file found \u2014 IP clarity unclear",
      "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)."
    },
    {
      "system": "solana-staking-tracker",
      "risk_type": "no_tests",
      "severity": "medium",
      "haircut": 10,
      "classification": "missing_evidence",
      "description": "No test coverage \u2014 functionality unverified",
      "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest."
    },
    {
      "system": "solana-staking-tracker",
      "risk_type": "no_receipts",
      "severity": "low",
      "haircut": 8,
      "classification": "missing_evidence",
      "description": "No execution receipts \u2014 claims unverifiable",
      "remediation": "Generate execution receipts for build/test/deploy commands."
    },
    {
      "system": "solana-staking-tracker",
      "risk_type": "dependency_vulnerability",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No lockfile \u2014 dependency versions not pinned",
      "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)."
    },
    {
      "system": "terminal_agent",
      "risk_type": "missing_license",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No license file found \u2014 IP clarity unclear",
      "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)."
    },
    {
      "system": "terminal_agent",
      "risk_type": "no_tests",
      "severity": "medium",
      "haircut": 10,
      "classification": "missing_evidence",
      "description": "No test coverage \u2014 functionality unverified",
      "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest."
    },
    {
      "system": "terminal_agent",
      "risk_type": "no_receipts",
      "severity": "low",
      "haircut": 8,
      "classification": "missing_evidence",
      "description": "No execution receipts \u2014 claims unverifiable",
      "remediation": "Generate execution receipts for build/test/deploy commands."
    },
    {
      "system": "terminal_agent",
      "risk_type": "dependency_vulnerability",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No lockfile \u2014 dependency versions not pinned",
      "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)."
    },
    {
      "system": "veis",
      "risk_type": "secret_leak",
      "severity": "low",
      "haircut": 8,
      "classification": "real",
      "description": "Exposed secrets or credentials detected",
      "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager."
    },
    {
      "system": "veis",
      "risk_type": "missing_license",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No license file found \u2014 IP clarity unclear",
      "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)."
    },
    {
      "system": "veis",
      "risk_type": "no_tests",
      "severity": "medium",
      "haircut": 10,
      "classification": "missing_evidence",
      "description": "No test coverage \u2014 functionality unverified",
      "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest."
    },
    {
      "system": "veis",
      "risk_type": "no_receipts",
      "severity": "low",
      "haircut": 8,
      "classification": "missing_evidence",
      "description": "No execution receipts \u2014 claims unverifiable",
      "remediation": "Generate execution receipts for build/test/deploy commands."
    },
    {
      "system": "veis",
      "risk_type": "dependency_vulnerability",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No lockfile \u2014 dependency versions not pinned",
      "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)."
    },
    {
      "system": "winserv_chatgpt_automation",
      "risk_type": "missing_license",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No license file found \u2014 IP clarity unclear",
      "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)."
    },
    {
      "system": "winserv_chatgpt_automation",
      "risk_type": "no_tests",
      "severity": "medium",
      "haircut": 10,
      "classification": "missing_evidence",
      "description": "No test coverage \u2014 functionality unverified",
      "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest."
    },
    {
      "system": "winserv_chatgpt_automation",
      "risk_type": "no_receipts",
      "severity": "low",
      "haircut": 8,
      "classification": "missing_evidence",
      "description": "No execution receipts \u2014 claims unverifiable",
      "remediation": "Generate execution receipts for build/test/deploy commands."
    },
    {
      "system": "winserv_chatgpt_automation",
      "risk_type": "dependency_vulnerability",
      "severity": "low",
      "haircut": 5,
      "classification": "missing_evidence",
      "description": "No lockfile \u2014 dependency versions not pinned",
      "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)."
    }
  ],
  "total_risks": 164,
  "high_severity": 2,
  "medium_severity": 36,
  "low_severity": 126
}