{
  "repo": "cert-manager",
  "full_name": "tidbcloud/cert-manager",
  "status": "scan_complete",
  "scan_started_at": "2026-03-28T13:49:17Z",
  "scan_completed_at": "2026-03-28T13:49:17Z",
  "expected_binaries": [
    {
      "name": "webhook",
      "path": "cmd/webhook/main.go",
      "status": "completed",
      "role": "primary_service"
    },
    {
      "name": "cainjector",
      "path": "cmd/cainjector/main.go",
      "status": "completed",
      "role": "worker"
    },
    {
      "name": "acmesolver",
      "path": "cmd/acmesolver/main.go",
      "status": "completed",
      "role": "worker"
    },
    {
      "name": "controller",
      "path": "cmd/controller/main.go",
      "status": "completed",
      "role": "worker"
    },
    {
      "name": "ctl",
      "path": "cmd/ctl/main.go",
      "status": "skipped",
      "role": "admin_cli",
      "skip_reason": "cli_only"
    }
  ],
  "scanned_binaries": [
    {
      "name": "webhook",
      "output_file": "cmd-webhook"
    },
    {
      "name": "cainjector",
      "output_file": "cmd-cainjector"
    },
    {
      "name": "acmesolver",
      "output_file": "cmd-acmesolver"
    },
    {
      "name": "controller",
      "output_file": "cmd-controller"
    }
  ],
  "skipped_binaries": [
    {
      "name": "ctl",
      "path": "cmd/ctl/main.go",
      "skip_reason": "cli_only"
    }
  ],
  "files_generated": [
    "interfaces/cmd-webhook.json",
    "interfaces/cmd-cainjector.json",
    "interfaces/cmd-acmesolver.json",
    "interfaces/cmd-controller.json",
    "service-mapping/cmd-webhook.json",
    "service-mapping/cmd-cainjector.json",
    "service-mapping/cmd-acmesolver.json",
    "service-mapping/cmd-controller.json"
  ],
  "scan_progress": {
    "completed": 4,
    "skipped": 1,
    "total": 5
  },
  "review_status": "pending",
  "codex_scan_at": "2026-03-28T13:49:17Z",
  "codex_scan_verdict": "scan_complete",
  "codex_scan_note": "Fresh source-backed codex scan corrected the binary scope for cert-manager. Besides webhook, the repo also ships long-running controller and cainjector managers plus the acmesolver HTTP01 pod binary; only cmd/ctl is a true CLI. The scan rebuilt interfaces and dependency mappings for those runtime components from source. A later meta-validation pass also corrected the runtime roles: controller, cainjector, and acmesolver are worker-style runtimes rather than admin CLIs."
}