Egonex-AI/Understand-Anything

What it measures: How tangled the control flow is — methods with many branches are hard to test and change.

Method: Cyclomatic complexity per method (1 + decision points), computed exhaustively across production source; test projects separated by convention. Deterministic.

Maturity: Documented → Verified → Prevented · effective 5.0 / 10 · rule-coverage 100% · ceiling Prevented

21 method(s) exceeded the cyclomatic complexity threshold of 15; the worst was merge-knowledge-graph.merge at 64.

+ 7 more group(s) — more in Appendix A; the complete list is findings.md.

What to do

1. Resolve the 1 buildResult (cyclomatic 34) finding(s) in Cyclomatic Complexity — start with extract-structure-result.mjs. — One of this dimension's main actionable groups (1 warning-level).
2. Resolve the 1 main (cyclomatic 31) finding(s) in Cyclomatic Complexity — start with compute-batches.mjs. — One of this dimension's main actionable groups (1 warning-level).
3. Resolve the 1 main (cyclomatic 28) finding(s) in Cyclomatic Complexity — start with scan-project.mjs. — One of this dimension's main actionable groups (1 warning-level).

Detailed fixes: d1_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: How hard the code is for a person to follow, beyond raw branching.

Method: Cognitive complexity per method (Sonar-style nesting-penalized score), computed exhaustively over production code, excluding test projects. Deterministic.

Maturity: Documented → Verified → Prevented · effective 2.0 / 10 · rule-coverage 100% · ceiling Prevented

29 method(s) exceeded the cognitive complexity threshold of 15; the worst was merge-batch-graphs.production_candidates at 130.

+ 12 more group(s) — more in Appendix A; the complete list is findings.md.

What to do

1. Resolve the 1 main (cognitive 54) finding(s) in Cognitive Complexity — start with extract-import-map.mjs. — One of this dimension's main actionable groups (1 warning-level).
2. Resolve the 1 resolveTsJsImport (cognitive 46) finding(s) in Cognitive Complexity — start with extract-import-map.mjs. — One of this dimension's main actionable groups (1 warning-level).
3. Resolve the 1 main (cognitive 43) finding(s) in Cognitive Complexity — start with compute-batches.mjs. — One of this dimension's main actionable groups (1 warning-level).

Detailed fixes: d2_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: Over-large classes that try to do too much ("god classes").

Method: God-class detection by line and method-count thresholds per logical type (partial classes unified), filtered for generated code and registration/contract false positives. Deterministic.

Maturity: Documented → Verified → Prevented · effective 0.0 / 10 · rule-coverage 100% · ceiling Prevented

6 god class(es) detected.

What to do

1. Resolve the 6 FileTooLong finding(s) in God Classes — start with compute-batches.mjs, extract-import-map.mjs, scan-project.mjs. — One of this dimension's main actionable groups (6 warning-level).
2. Enforce God Classes in CI to reach Verified (currently Documented). — Hardens enforcement from Documented toward Prevented — provenance only; does not change the score.

Detailed fixes: d3_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: Copy-pasted code that should be shared instead.

Method: Code duplication via token-stream sliding windows with type-aware normalization (locals masked, type names preserved), density-scored per KLoC of production code. Deterministic.

Maturity: Documented → Verified → Prevented · effective 9.0 / 10 · rule-coverage 100% · ceiling Verified

4 duplicated block group(s) detected.

✓ On the Gold path — maintain.

Detailed fixes: d4_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: Whether volatile projects sit underneath others that depend on them (so their churn ripples upward), and whether project dependencies form cycles. A widely-depended-on but stable shared/kernel project is healthy, not penalised.

Method: Dependency cycles via elementary-DFS over real .csproj references, plus Martin instability (afferent/efferent) per project. Exhaustive over the reference graph, deterministic.

Coverage: Exhaustive · type-level: afferent/efferent coupling + cycles computed over every production type — the population is all types, not a name convention.

Maturity: Documented → Verified → Prevented · effective 6.9 / 10 · rule-coverage 100% · ceiling Prevented

0 projects, 0 dependency cycle(s), 0 unstable depended-on project(s).

What to do

1. Improve Coupling — currently 6.9/10. — 0 projects, 0 dependency cycle(s), 0 unstable depended-on project(s).

Detailed fixes: d5_recommendation.md.

What it measures: Whether the code respects its intended layering / architecture rules.

Method: Enforcement rung (Prevented/Verified/Documented) per checkable ADR via Roslyn, plus dependency cycles via the engine shared with D5/AX3. Deterministic, exact.

Maturity: Documented → Verified → Prevented · effective 10.0 / 10 · rule-coverage 100% · ceiling Prevented

Of 30 mechanizable ADRs, 23 are prevented by analyzers, 7 by tests, 0 exist only in prose. Coverage: 100 %. Cycles found: 0.

✓ On the Gold path — maintain.

Detailed fixes: d7_recommendation.md.

What it measures: Whether the test suite has a healthy mix of unit / integration / end-to-end tests.

Method: Test projects classified (Unit/Integration/BDD/E2E) from compiled metadata; test methods counted exhaustively across projects with placement-agnostic disk fallback. Deterministic.

Maturity: Documented → Verified → Prevented · effective 0.0 / 10 · rule-coverage 100% · ceiling Documented

No test projects found.

What to do

1. Resolve the 1 No tests found finding(s) in Test Distribution. — One of this dimension's main actionable groups (1 recommendation-level).

Detailed fixes: d9_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: Whether dependencies are current, secure, and not bloated.

Method: Manifest scan via dotnet list package across all projects; worst-signal-per-package deduction (saturating for vulnerabilities, capped-linear for deprecation/outdated) per KLoC. Exhaustive, deterministic.

Maturity: Documented → Verified → Prevented · effective 10.0 / 10 · rule-coverage 100% · ceiling Verified

0 outdated, 0 vulnerable, 0 deprecated packages.

✓ On the Gold path — maintain.

Detailed fixes: d12_recommendation.md.

What it measures: Whether any secrets (keys, tokens, passwords) have leaked into the code.

Method: In-process native secret scanner (entropy plus signature patterns) across all tracked files; no external tool. A clean result is a measured 10, not no-data zero. Deterministic.

Maturity: Documented → Verified → Prevented · effective 10.0 / 10 · rule-coverage 100% · ceiling Prevented

Secret scan ran and found no leaked secrets.

✓ On the Gold path — maintain.

Detailed fixes: d13_recommendation.md.

What it measures: Files that change often and are also complex — the riskiest hotspots.

Method: Per production file churn times cyclomatic complexity over a rolling window, computed from git and Roslyn/JS/Razor analysis. Exhaustive, deterministic per commit date.

Maturity: Documented → Verified → Prevented · effective 9.8 / 10 · rule-coverage 100% · ceiling Documented

Top hotspots: understand-anything-plugin/packages/dashboard/src/App.tsx (18×35=630); understand-anything-plugin/skills/understand/extract-import-map.mjs (20×27=540); understand-anything-plugin/skills/understand/compute-batches.mjs (17×31=527)

✓ On the Gold path — maintain.

Detailed fixes: d15_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: Whether knowledge is concentrated in too few people (the "bus factor").

Method: Living knowledge per author via time-decayed commit attribution (6-month half-life, focus weighting) across largest source files. Deterministic, avoids blame's mechanical-refactor false positives.

Maturity: Documented → Verified → Prevented · effective 10.0 / 10 · rule-coverage 100% · ceiling Documented

No source file's living knowledge is concentrated in a single author.

✓ On the Gold path — maintain.

Detailed fixes: d16_recommendation.md.

What it measures: Whether the project's documentation is clear, complete, and useful.

Method: Judged by language model at low temperature (0.0-0.1) on a deterministic doc sample (READMEs plus first 25 architecture docs), with two-pass stability filtering. Advisory, sampled.

Maturity: Documented → Verified → Prevented · effective Exemplary / 10 · rule-coverage 100% · ceiling Documented

Understand Anything is a top-tier AI knowledge graph tool with comprehensive documentation: an English README plus 24 multi-language READMEs and 18 architecture/design docs covering features, installation, platform compatibility, the two-phase structural-analysis script, semantic layer assignment, and a dedicated large-monorepo benchmark. The open-source project's documentation is clear, complete, and well-structured for its target audience.

✓ On the Gold path — maintain.

Detailed fixes: d19_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: Whether architecture decisions are recorded well (context, decision, consequences).

Method: Per-ADR judgment by language model at low temperature with two-pass stability; confidence is share of ADRs evaluated; enforcement-field presence detected deterministically. Advisory.

Maturity: Documented → Verified → Prevented · effective Strong / 10 · rule-coverage 100% · ceiling Documented

Evaluated 39 ADR(s) individually; mean quality 7.8/10 (mixed — many ADRs miss context or consequences). 6 flagged with a specific gap.

+ 1 more group(s) — more in Appendix A; the complete list is findings.md.

What to do

1. Resolve the 1 Context/problem and consequences/trade-offs are absent; only a… finding(s) in ADR Quality — start with 2026-03-14-phase1-implementation.md. — One of this dimension's main actionable groups (1 warning-level).
2. Resolve the 1 Context/problem and consequences/trade-offs are absent from the visible… finding(s) in ADR Quality — start with 2026-03-15-homepage-implementation.md. — One of this dimension's main actionable groups (1 warning-level).
3. Resolve the 1 Context injection task is cut at 'readm' by the scanner clip marker;… finding(s) in ADR Quality — start with 2026-03-18-multi-platform-simple-implementation.md. — One of this dimension's main actionable groups (1 warning-level).

Detailed fixes: d20_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: Whether names — types, methods, variables — are clear and consistent.

Method: Judged by language model at low temperature (0.0-0.1) on a deterministic random symbol sample (fixed size, not exhaustive), with disclosed confidence band. Advisory, sampled.

Maturity: Documented → Verified → Prevented · effective Exemplary / 10 · rule-coverage 100% · ceiling Verified

0 naming inconsistencies across 0 sampled symbols.

✓ On the Gold path — maintain.

Detailed fixes: d21_recommendation.md.

What it measures: Whether the code actually follows the decisions recorded in the project's ADRs.

Method: Judged by language model at low temperature against ADRs plus a deterministic structural code summary; findings linked to repo-rooted ADR paths for traceability. Advisory.

Maturity: Documented → Verified → Prevented · effective Exemplary / 10 · rule-coverage 100% · ceiling Verified

17 conform / 0 violate across 39 ADRs.

✓ On the Gold path — maintain.

Detailed fixes: d25_recommendation.md.

What it measures: Whether each project is a focused, coherent unit rather than an oversized grab-bag.

Method: Project size overshoot penalties (LoC / public-type count / namespace count, 2-of-3 flag) weighted by log magnitude. Exhaustive across projects, deterministic, LLM-independent.

Maturity: Documented → Verified → Prevented · effective 10.0 / 10 · rule-coverage 100% · ceiling Documented

No projects to assess.

✓ On the Gold path — maintain.

Detailed fixes: d26_recommendation.md.

What it measures: How far you must trace to follow a call — low indirection and co-located slices read easier.

Method: Call indirection (interface hops, cross-namespace calls, slice-locality scaled) over a sampled set of method invocations, size-aware baseline. Sampled; confidence discounted by symbol-resolution gaps.

Coverage: Slice locality from the first namespace segments, SAMPLED (≤400 methods) — not exhaustive.

Maturity: Documented → Verified → Prevented · effective 10.0 / 10 · rule-coverage 100% · ceiling Documented

Too little code to assess navigability.

✓ On the Gold path — maintain.

Detailed fixes: d27_recommendation.md.

What it measures: Whether any secrets were ever committed — scanned across the full git history, not just now.

Method: Git-history secret scan via gitleaks detect over full history in an isolated checkout; each match flagged High. Exhaustive; degrades cleanly when tool absent.

Maturity: Documented → Verified → Prevented · effective 10.0 / 10 · rule-coverage 100% · ceiling Documented

gitleaks scanned the full history AND the current working tree and found no secrets.

✓ On the Gold path — maintain.

Detailed fixes: d28_recommendation.md.

What it measures: Real static-analysis (SAST) findings — likely security bugs in the code, any language.

Method: Polyglot static analysis via semgrep across the repo using the pinned, image-baked p/security-audit + p/owasp-top-ten rulesets (no scan-time registry fetch); severity rules (ERROR/WARNING/INFO) map to a full-band severity-weighted score. Exhaustive, deterministic; degrades on parse failure.

Coverage: semgrep pattern rules over all files — exhaustive for the rule set, blind to classes of bug without a rule (clean = no rule matched).

Maturity: Documented → Verified → Prevented · effective 0.6 / 10 · rule-coverage 100% · ceiling Documented

16 finding(s): 0 critical, 16 high, 0 medium, 0 low.

What to do

1. Resolve the 16 High finding(s) in Static Analysis (SAST) — start with pnpm-workspace.yaml (6), deploy-homepage.yml (5), ci.yml (4). — One of this dimension's main actionable groups (16 issue-level).

Detailed fixes: d29_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: Whether Dockerfiles / Terraform / Kubernetes config follow security best practices.

Method: IaC/container misconfiguration scan via trivy config (Dockerfile/Terraform/K8s/Helm/CloudFormation); severity rules to 0-10 moderate normalizer. NotApplicable without manifests. Exhaustive, deterministic.

Maturity: Documented → Verified → Prevented · effective 10.0 / 10 · rule-coverage 100% · ceiling Documented

trivy found no infrastructure-as-code or container misconfigurations.

✓ On the Gold path — maintain.

Detailed fixes: d31_recommendation.md.

What it measures: Whether JavaScript/npm dependencies have known published vulnerabilities (CVEs) — the npm ecosystem's biggest risk.

Method: JS/npm CVE scan via trivy fs --scanners vuln over JS manifests (package.json/yarn.lock/pnpm-lock/bun.lockb); 0-10 tight normalizer. NotApplicable without JS manifests. Exhaustive, deterministic.

Maturity: Documented → Verified → Prevented · effective 10.0 / 10 · rule-coverage 100% · ceiling Documented

No known-vulnerable JS/npm dependencies.

✓ On the Gold path — maintain.

Detailed fixes: d33_recommendation.md.

What it measures: Whether anyone still has living knowledge of each file, or it has been orphaned — last understood long ago by someone now gone quiet. The sibling of the bus factor: D16 asks who owns it, D34 asks whether anyone still knows it.

Method: File orphaning as total living-knowledge decay below one focused-commit's worth within a year, computed per-file from the D16 decay model. Exhaustive, deterministic over fixed history.

Maturity: Documented → Verified → Prevented · effective 10.0 / 10 · rule-coverage 100% · ceiling Documented

Every significant source file has living knowledge — recently and meaningfully worked.

✓ On the Gold path — maintain.

Detailed fixes: d34_recommendation.md.

What it measures: Whether files that change together actually belong together — pairs that repeatedly co-change in git history despite having no explicit code dependency, surfacing the hidden/logical coupling (and boundaries in the wrong place) a static scan can't see.

Method: Pairwise co-occurrence over the per-commit file sets in git history (production source only — tests and generated dropped): Degree-of-Coupling = shared ÷ min individual revisions, reported above noise floors (each file ≥10 revisions, ≥5 shared commits, ≥50% strength); sweeping commits excluded. Deterministic over fixed history.

Coverage: Population: PRODUCTION source files only — test and generated files are dropped before pairing, so a class co-changing with its own test (trivially ~100%) can't drown the real production↔production coupling. Pairs ranked by Degree-of-Coupling; coupling through a build step, config, or non-source file isn't seen.

Maturity: Documented → Verified → Prevented · effective 7.3 / 10 · rule-coverage 100% · ceiling Documented

Strongest change-coupling: zh-TW.ts↔zh.ts 64%; ko.ts↔zh.ts 64%; ko.ts↔zh-TW.ts 64%

What to do

1. Resolve the 10 Change coupling finding(s) in Change Coupling — start with en.ts (4), ja.ts (3), ko.ts (2). — One of this dimension's main actionable groups (10 warning-level).

Detailed fixes: d35_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: Whether the build pipeline provides supply-chain integrity — generated provenance/attestation, signed artifacts (cosign/sigstore), an SBOM, and pinned build actions. Presence of the configuration, not a runtime guarantee.

Method: Supply-chain provenance/signing read deterministically from CI/build config (.github/workflows, .gitlab-ci.yml, azure-pipelines, Jenkinsfile, .circleci) + the release surface: four signals — generated provenance/attestation (SLSA/in-toto/actions-attest), artifact signing (cosign/sigstore/gitsign), an SBOM (syft/sbom-action/*.spdx.json/*.cdx.json), and SHA-pinned build actions — scored 10·present/denom. NotApplicable without a build pipeline. Detects configuration presence, not runtime enforcement.

Maturity: Documented → Verified → Prevented · effective 0.0 / 10 · rule-coverage 100% · ceiling Documented

0/4 supply-chain integrity signals present (provenance, signing, SBOM, pinned actions).

What to do

1. Resolve the 1 Unpinned build actions finding(s) in Supply-chain Provenance & Signing. — One of this dimension's main actionable groups (1 warning-level).
2. Resolve the 1 No build provenance finding(s) in Supply-chain Provenance & Signing. — One of this dimension's main actionable groups (1 recommendation-level).
3. Resolve the 1 No artifact signing finding(s) in Supply-chain Provenance & Signing. — One of this dimension's main actionable groups (1 recommendation-level).

Detailed fixes: d36_recommendation.md · top locations in Appendix A, every location in findings.md.

What it measures: Whether the repository publishes a coordinated-vulnerability-disclosure policy (SECURITY.md or security.txt) with a reporting contact, so finders know how to report a vulnerability. Presence of a policy file with a contact, not whether the policy is adequate or honoured.

Method: Vulnerability-disclosure policy read deterministically from the repo: a SECURITY.md (root/.github/docs) or .well-known/security.txt / security.txt, regex-checked for a reporting contact (email / URL / mailto). Present + contact → 10; present without a contact → 4; NotApplicable when no policy file exists (it may live off-repo). Detects the policy file's presence + contact, not its adequacy.

Maturity: Documented → Verified → Prevented · effective 10.0 / 10 · rule-coverage 100% · ceiling Documented

A vulnerability-disclosure policy (SECURITY.md) is published with a reporting contact.

✓ On the Gold path — maintain.

Detailed fixes: d37_recommendation.md.

What it measures: Whether dependencies have known published vulnerabilities (CVEs) per the OSV database — npm and other lockfile ecosystems, parsed natively. Complements D33 (npm via trivy) and D30 (.NET via dotnet).

Method: npm/multi-ecosystem CVE scan via osv-scanner (queries the osv.dev database + parses lockfiles natively: package-lock/yarn/pnpm/bun); severity tally (Critical/High/Medium/Low) to 0-10 tight normalizer (8.0). NotApplicable without a JS lockfile. Additive to D33 (trivy fs); exhaustive + deterministic, DB kept fresh.

Maturity: Documented → Verified → Prevented · effective 0.0 / 10 · rule-coverage 100% · ceiling Documented

34 finding(s): 1 critical, 17 high, 13 medium, 3 low.

What to do

1. Resolve the 17 High CVE finding(s) in OSV Dependency Vulnerabilities — start with pnpm-lock.yaml (17). — One of this dimension's main actionable groups (17 issue-level).
2. Resolve the 13 Medium CVE finding(s) in OSV Dependency Vulnerabilities — start with pnpm-lock.yaml (13). — One of this dimension's main actionable groups (13 warning-level).
3. Resolve the 1 Critical CVE finding(s) in OSV Dependency Vulnerabilities — start with pnpm-lock.yaml. — One of this dimension's main actionable groups (1 issue-level).

Detailed fixes: d38_recommendation.md · top locations in Appendix A, every location in findings.md.

Other · Architecture — Whether the codebase has a recognisable, scale-appropriate structure (a named architectural style, or modular enough for its size) rather than being an ad-hoc ball of mud.

Method: Roslyn plus csproj analysis: architecture style detection (DDD, clean, vertical-slice, CQRS) and structure fitness for repo size. Deterministic.

Maturity · Maturity — Whether the repo and its projects have a README, and whether it's substantive and current.

Method: Filesystem scan: README presence, word count, and headings for depth; git history for staleness. Exhaustive across root and project dirs, deterministic.

What to do

• Add a 'Testing' section to the root README — how to run the test suite.
• Add an 'Architecture' / 'How it works' section to the root README — the high-level shape.

Maturity · Maturity — Whether key decisions (ADRs) and the high-level shape (C4/diagrams) are written down.

Method: Filesystem scan: ADR folder/naming conventions or content, plus Mermaid/PlantUML/C4/architecture.md discovery. Exhaustive, deterministic.

What to do

• Grow the ADR log (currently 39) — reach 50 to raise the maturity tier; document significant decisions as they're made.

Maturity · Maturity — Whether the repo is organised deliberately — src/test separation and consistent project naming.

Method: Filesystem scan: src/test folder separation and namespace-prefix consistency (majority RootNamespace agreement). Exhaustive across projects, deterministic.

• Projects aren't grouped under a src/ folder — production and tooling code are mixed at the root.

What to do

• Group production code under src/ (or split deliberately, e.g. backend/ + frontend/) so production and tooling code aren't mixed at the root.

Maturity · Maturity — Whether the README actually describes the code that exists (LLM-judged, advisory).

Method: Judged by language model at low temperature: README accuracy versus actual projects, within a disclosed tolerance. Advisory, not a measured number.

• README advertises a microservices architecture, but the repo is a single project with no service manifests

What to do

• Reconcile the README with reality: README advertises a microservices architecture, but the repo is a single project with no service manifests.

Readiness · Readiness — Whether an automated pipeline builds and tests every change.

Method: Filesystem scan: CI workflow files (.github/workflows, .gitlab-ci.yml, etc.) for build and test stages. Exhaustive, deterministic.

Readiness · Readiness — Whether the code is diagnosable in production — structured logging, tracing/metrics, health checks.

Method: Filesystem/Roslyn scan: structured-logging frameworks (Serilog, NLog), OpenTelemetry, and health-check endpoint patterns. Exhaustive, deterministic.

• No ILogger/Serilog usage found — production issues will be hard to diagnose.

What to do

• Adopt ILogger (or Serilog) and log at meaningful points across the projects.
• Consider OpenTelemetry tracing/metrics and a health-check endpoint for operability.

Readiness · Readiness — Whether SAST, secret/dependency scanning and performance benchmarking are wired in (presence, not runtime).

Method: Filesystem/Roslyn scan: CodeQL, Dependabot, secret-scanning, and BenchmarkDotNet presence in pipelines and projects. Exhaustive, deterministic.

• No static application security testing (CodeQL / security analyzers / codehealth) detected.

What to do

• Add a SAST step (e.g. CodeQL) or a security analyzer package.
• Enable Dependabot/Renovate or a dependency-review gate.
• Add gitleaks/trufflehog in CI to block PRs that introduce committed secrets.

Readiness · Readiness — Whether releases are automated and safely reversible (probes, rolling updates, approval gates) — from manifests/pipeline files, not the live environment.

Method: Filesystem scan: deployment manifests/IaC (K8s YAML, Helm, Terraform) for rolling updates, probes, approval gates, migration hooks. Exhaustive, deterministic.

• Deployment automation exists but no readiness/liveness probes, rolling-update strategy, lifecycle hooks or migration job were evidenced — a bad release is harder to detect and reverse.

What to do

• Add readiness/liveness probes and a rolling-update (or blue/green) strategy so a bad release is caught and rolled back automatically.
• Add an approval/environment gate (required reviewers / protection rules) before production promotion.

React / JS · Code Health — How much of the frontend is typed TypeScript vs untyped JavaScript.

Method: Frontend file inventory: the share of typed TypeScript vs untyped JavaScript across the source tree. Deterministic, exhaustive over frontend files.

What to do

• Migrate the remaining .js/.jsx files to TypeScript.

React / JS · Code Health — Copy-pasted token-identical blocks across the frontend (the D4 clone algorithm over JS/TS tokens, D-386).

Method: Copy-pasted token-identical blocks across the frontend (the D4 clone algorithm run over JS/TS tokens). Deterministic.

• understand-anything-plugin/packages/core/src/plugins/extractors/__tests__/cpp-extractor.test.ts:61 · understand-anything-plugin/packages/core/src/plugins/extractors/__tests__/cpp-extractor.test.ts:78 · understand-anything-plugin/packages/core/src/plugins/extractors/__tests__/cpp-extractor.test.ts:98 · understand-anything-plugin/packages/core/src/plugins/extractors/__tests__/cpp-extractor.test.ts:183 — cpp-extractor.test.ts:61
• scripts/generate-large-graph.mjs:32 · understand-anything-plugin/packages/core/src/ignore-generator.ts:13 — generate-large-graph.mjs:32
• understand-anything-plugin/packages/core/src/plugins/extractors/__tests__/cpp-extractor.test.ts:372 · understand-anything-plugin/packages/core/src/plugins/extractors/__tests__/cpp-extractor.test.ts:413 · understand-anything-plugin/packages/core/src/plugins/extractors/__tests__/csharp-extractor.test.ts:303 · understand-anything-plugin/packages/core/src/plugins/extractors/__tests__/dart-extractor.test.ts:465 — cpp-extractor.test.ts:372
• understand-anything-plugin/packages/core/src/plugins/extractors/__tests__/cpp-extractor.test.ts:204 · understand-anything-plugin/packages/core/src/plugins/extractors/__tests__/cpp-extractor.test.ts:244 · understand-anything-plugin/packages/core/src/plugins/extractors/__tests__/cpp-extractor.test.ts:295 · understand-anything-plugin/packages/core/src/plugins/extractors/__tests__/cpp-extractor.test.ts:369 — cpp-extractor.test.ts:204
• understand-anything-plugin/packages/core/src/plugins/extractors/__tests__/cpp-extractor.test.ts:305 · understand-anything-plugin/packages/core/src/plugins/extractors/__tests__/python-extractor.test.ts:476 · understand-anything-plugin/packages/core/src/plugins/extractors/__tests__/rust-extractor.test.ts:593 · understand-anything-plugin/packages/core/src/plugins/extractors/__tests__/rust-extractor.test.ts:678 — cpp-extractor.test.ts:305
• understand-anything-plugin/packages/core/src/plugins/extractors/__tests__/php-extractor.test.ts:579 · understand-anything-plugin/packages/core/src/plugins/extractors/__tests__/python-extractor.test.ts:580 · understand-anything-plugin/packages/core/src/plugins/extractors/__tests__/ruby-extractor.test.ts:582 — php-extractor.test.ts:579
• understand-anything-plugin/packages/core/src/plugins/extractors/__tests__/cpp-extractor.test.ts:487 · understand-anything-plugin/packages/core/src/plugins/extractors/__tests__/csharp-extractor.test.ts:411 · understand-anything-plugin/packages/core/src/plugins/extractors/__tests__/csharp-extractor.test.ts:430 · understand-anything-plugin/packages/core/src/plugins/extractors/__tests__/csharp-extractor.test.ts:449 — cpp-extractor.test.ts:487
• understand-anything-plugin/packages/core/src/plugins/extractors/__tests__/cpp-extractor.test.ts:233 · understand-anything-plugin/packages/core/src/plugins/extractors/__tests__/csharp-extractor.test.ts:357 · understand-anything-plugin/packages/core/src/plugins/extractors/__tests__/go-extractor.test.ts:130 · understand-anything-plugin/packages/core/src/plugins/extractors/__tests__/go-extractor.test.ts:359 — cpp-extractor.test.ts:233

What to do

• Extract the duplicated blocks into shared functions/components.

React / JS · Architecture — Conformance to the detected frontend architecture layout (feature-sliced / layered src) plus cross-package deep-import rules (D-386).

Method: Conformance to the detected frontend layout (feature-sliced / layered src) plus cross-package deep-import rules, over the module graph. Deterministic.

• tests/skill/understand/test_extract_structure_outcomes.test.mjs:3 reaches into another package with a relative path (../../../understand-anything-plugin/skills/understand/extract-structure-result.mjs) — import the package by name instead. — test_extract_structure_outcomes.test.mjs:3
• understand-anything-plugin/packages/dashboard/vite.config.ts:9 reaches into another package with a relative path (../core/src/staleness) — import the package by name instead. — vite.config.ts:9

What to do

• Fix the listed violations: import through public entries (package exports / slice index), never reach into another layer or package's internals.

React / JS · Code Health — Per-function cyclomatic/cognitive complexity from the token-level function scanner (D-386) — real branching, not a regex heuristic.

Method: Per-function cyclomatic/cognitive complexity from a token-level function scanner (real branching, not a regex heuristic), computed over every frontend function. Deterministic.

• Branch-heavy code is where defects cluster — extract decisions into smaller functions. (×8) — large-repo-benchmark.mjs:1257, App.tsx:274, extract-structure-result.mjs:216, …

What to do

• Break down the listed branch-heavy functions; aim P95 cyclomatic ≤ 5.

React / JS · Code Health — How many components/modules exceed the large-file threshold.

Method: Components/modules exceeding the large-file threshold, counted exhaustively across the frontend source tree. Deterministic.

• 19 file(s) over 400 lines

What to do

• Split the oversized components into smaller, focused ones.

React / JS · Readiness — Static test reachability (D-386): the share of production files reachable from any test via the import graph — measured without running anything.

Method: Static test reachability: the share of production files reachable from any test via the import graph — measured without running anything. Deterministic.

• No test imports this module directly or transitively — its behavior is unverified. (×8) — large-repo-benchmark.mjs, extract-import-map.mjs, scan-project.mjs, …

What to do

• Add tests that import the unreached modules (directly or through their public entry).

React / JS · Readiness — Whether the project wires up test, lint and typecheck — detected from each package.json script's COMMAND (eslint / tsc / vitest / jest / playwright), not just its name, and corroborated against CI-workflow invocations so a tool run only in CI still counts.

Method: package.json scanned for test/lint/typecheck script wiring. Deterministic presence check.

• test ✓ · lint ✓ · typecheck ✗

What to do

• Add the missing tooling (eslint, tsc) as package.json scripts and run them in CI.

React / JS · Code Health — Files unreachable from every application/tooling/test entry point, and exports nothing imports (module-graph reachability, D-386).

Method: Dead code: files unreachable from every application/tooling/test entry point plus exports nothing imports, via module-graph reachability. Deterministic, exhaustive over the import graph.

• Unreachable from the 6 application, 8 tooling and 77 test entry point(s) detected in this repo. Gate removals on your build/type-check — an undetected custom entry would make these reachable.
• no import path from any entry point (6 application, 8 tooling, 77 test roots considered) (×7) — extract-import-map.mjs, scan-project.mjs, compute-batches.mjs, …

What to do

• Delete the dead files and unused exports — every line is maintenance cost and rebuild-estimate inflation with zero runtime value.

React / JS · Readiness — npm dependency truthfulness (D-386): unused dependencies, imports not declared anywhere, and type-/test-only packages shipped as production deps.

Method: npm dependency truthfulness: unused dependencies, imports declared nowhere, and type-/test-only packages shipped as production deps — from the manifest + import graph. Deterministic.

• Declared in the root/package.json but never imported anywhere in that package or its workspace members — dead weight and attack surface. Verify against build tooling before removing.
• Declared in understand-anything-plugin/packages/core/package.json but never imported anywhere in that package or its workspace members — dead weight and attack surface. Verify against build tooling before removing. (×2)

What to do

• Remove unused dependencies, declare unlisted imports explicitly, and demote type-/test-only packages to devDependencies.

React / JS · Architecture — Import cycles in the module graph (D-386) — files that can only be understood and changed together.

Method: Import cycles in the module graph, detected exhaustively over JS/TS imports (the same cycle detection as the .NET coupling dimension). Deterministic.

Other · Code Health — Whether the code avoids sync-over-async (deadlock-prone blocking on tasks) and async void.

Method: Roslyn syntax scan: async methods scanned for .Wait()/.GetAwaiter().GetResult() and async-void outside event handlers. Deterministic, hard fact per invocation.

Other · Code Health — Whether exceptions are handled rather than silently swallowed or rethrown with lost stack traces.

Method: Roslyn syntax scan: every catch clause counted; empty catches and bare rethrows flagged. Population is all catch clauses, not estimated. Deterministic, hard fact.

Other · Code Health — Whether log calls use message templates (queryable) rather than interpolated strings.

Method: Roslyn syntax scan: every log call-site counted; interpolated-string first-argument violations flagged. Population is all log calls, not estimated. Deterministic.