Overview
The single-object form of the CI/CD pipeline scan: pass one job or step snippet (with an optional CI-system hint) and get the same deterministic static analysis as /ci/scan, restricted to per-object rules (no cross-object graph pass). Useful for an agent validating one step it just wrote. Output is a verdict, a risk score and findings with the rule id, severity, object, location, a concrete fix hint and safe truncated evidence. Pure local computation, no network, no keys. Sec