{
  "artifact_id": "sample-2",
  "count": 4,
  "severity_spread": {
    "critical": 0,
    "high": 0,
    "medium": 0,
    "low": 2,
    "info": 2
  },
  "findings": [
    {
      "id": "sample-2/f-001",
      "rule": "QUAL-LONG-002",
      "family": "quality",
      "severity": "low",
      "title": "File length 280 lines — approaches maintainability threshold",
      "file": "cmd/svp/main.go",
      "line": 1,
      "evidence": {
        "source_extract": "package main // entrypoint dispatch + cobra command tree",
        "confidence": 0.85,
        "reasoning": "File exceeds the 200-line soft threshold. Not blocking on its own; consider splitting command implementations into per-command files as the CLI grows.",
        "detector": "svp-parser (structural metric)"
      },
      "recommendation": "Move each cobra command into its own file under cmd/svp/commands/ as the command tree expands."
    },
    {
      "id": "sample-2/f-002",
      "rule": "QUAL-LONG-002",
      "family": "quality",
      "severity": "low",
      "title": "File length 301 lines — approaches maintainability threshold",
      "file": "internal/apiclient/client.go",
      "line": 1,
      "evidence": {
        "source_extract": "package apiclient // HTTP client for all backend services",
        "confidence": 0.85,
        "reasoning": "File exceeds the 200-line soft threshold. The client wraps 4 services in one file; splitting by service surface would keep this under 200 lines.",
        "detector": "svp-parser (structural metric)"
      },
      "recommendation": "Consider splitting into per-service files (identity.go, projects.go, snapshots.go, findings.go)."
    },
    {
      "id": "sample-2/f-003",
      "rule": "DEP-FRESHNESS-001",
      "family": "supply-chain",
      "severity": "info",
      "title": "Dependency `github.com/spf13/cobra@v1.8.1` — not the latest minor",
      "file": "go.mod",
      "line": 6,
      "evidence": {
        "source_extract": "\tgithub.com/spf13/cobra v1.8.1",
        "confidence": 0.75,
        "reasoning": "cobra 1.8.1 is stable and unaffected by known CVEs. Newer minors are available with QoL improvements. Informational only — no security impact.",
        "detector": "svp-dependency + OSV feed"
      },
      "recommendation": "Optional bump when convenient; no urgency."
    },
    {
      "id": "sample-2/f-004",
      "rule": "META-SNAPSHOT-CLEAN",
      "family": "quality",
      "severity": "info",
      "title": "Clean pipeline snapshot — every gate satisfied",
      "file": "go.mod",
      "line": 1,
      "evidence": {
        "source_extract": "module github.com/svp/cli",
        "confidence": 1,
        "reasoning": "No critical, high, or medium findings. All policy gates pass. This snapshot is publishable without waivers.",
        "detector": "svp-policy (meta)"
      },
      "recommendation": "Nothing to do. This is what a passing snapshot looks like."
    }
  ]
}