{
  "repo": "cloud-provider-aws",
  "full_name": "tidbcloud/cloud-provider-aws",
  "status": "scan_complete",
  "scan_started_at": "2026-03-28T13:52:45Z",
  "scan_completed_at": "2026-03-28T13:52:45Z",
  "expected_binaries": [
    {
      "name": "ecr-credential-provider",
      "path": "cmd/ecr-credential-provider/main.go",
      "status": "skipped",
      "role": "tool",
      "skip_reason": "exec_plugin_not_service"
    },
    {
      "name": "aws-cloud-controller-manager",
      "path": "cmd/aws-cloud-controller-manager/main.go",
      "status": "completed",
      "role": "worker"
    }
  ],
  "scanned_binaries": [
    {
      "name": "aws-cloud-controller-manager",
      "output_file": "cmd-aws-cloud-controller-manager"
    }
  ],
  "skipped_binaries": [
    {
      "name": "ecr-credential-provider",
      "path": "cmd/ecr-credential-provider/main.go",
      "skip_reason": "exec_plugin_not_service"
    }
  ],
  "files_generated": [
    "interfaces/cmd-aws-cloud-controller-manager.json",
    "service-mapping/cmd-aws-cloud-controller-manager.json"
  ],
  "scan_progress": {
    "completed": 1,
    "skipped": 1,
    "total": 2
  },
  "review_status": "pending",
  "codex_scan_at": "2026-03-28T13:52:45Z",
  "codex_scan_verdict": "scan_complete",
  "codex_scan_note": "Fresh source-backed codex scan corrected the runtime scope of cloud-provider-aws. The ecr-credential-provider binary is a kubelet exec credential plugin that communicates over stdin/stdout and does not expose a service surface, while aws-cloud-controller-manager is the actual long-running controller process that should remain in scope. A later meta-validation pass also corrected the manager role from CLI to worker."
}